chore(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1 in the github-actions group - #795
Merged
CybotTM merged 2 commits intoAug 18, 2026
Conversation
Bumps the github-actions group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner). Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@bf7454d...b09bb98) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #795 +/- ##
==========================================
+ Coverage 89.33% 89.35% +0.01%
==========================================
Files 88 88
Lines 12220 12220
==========================================
+ Hits 10917 10919 +2
+ Misses 1003 1000 -3
- Partials 300 301 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
CybotTM
approved these changes
Aug 18, 2026
CybotTM
left a comment
CybotTM
left a comment
Member
There was a problem hiding this comment.
Reviewed by hand — the bot review was unavailable for most of this batch (Copilot's monthly quota), so stating that this had a human reader rather than implying one.
go-check / govulncheck is SUCCESS here now. It was failing for six standard-library findings that had nothing to do with this pin bump; #796 moved the toolchain to go1.26.6, and this branch was updated onto it.
The pin itself: the commit this writes is what step-security/harden-runner's own v2.20.1 tag ref points at, read from that repository. Worth noting that v2.21.0 is already current elsewhere in the fleet, so the bot will follow up here.
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
Aug 18, 2026
CybotTM
deleted the
dependabot/github_actions/github-actions-b7f32a788f
branch
August 18, 2026 13:42
KamilPesek
pushed a commit
to KamilPesek/ofelia
that referenced
this pull request
Aug 19, 2026
`go-check / govulncheck` is failing on every pull request in this repository, and nothing in the tree caused it. ## The findings Six, all in the Go standard library, none in a dependency: | | package | fixed in | |---|---|---| | GO-2026-6218 | `net/url` | go1.26.6 | | GO-2026-6091 | `html/template` | go1.26.6 | | GO-2026-6090 | `crypto/tls` | go1.26.6 | | GO-2026-6089 | `net/http` | go1.26.6 | | GO-2026-5972 | `encoding/asn1` | go1.26.6 | | GO-2026-5026 | `net/http` | go1.26.6 | Each was found reachable — govulncheck's symbol results name real call paths, for example `middlewares/slack.go:118` reaching `url.URL.Parse` through `http.Client.Do`, and `middlewares/mail.go:287` reaching `template.Template.Execute`. So these are not theoretical for this binary. ## The change `go.mod` said `toolchain go1.26.5`. go1.26.6 is the current stable release, checked against `go.dev/dl` rather than assumed. It is the only version pin in the repository — a repo-wide sweep for the old string returns nothing else. The reusable `go-check` workflow resolves its toolchain from `go-version-file`, which defaults to `go.mod`, so this one line is what CI installs. `GOTOOLCHAIN` is set to `local` in the govulncheck step, meaning Go will not silently fetch a different toolchain than the one set up — which is why the `go.mod` line has to be the thing that moves. ## Verification **Not run locally**, and saying so rather than implying otherwise: this is a toolchain bump whose effect only shows under the CI-installed Go. The check that was failing is the one that has to report on this, and `govulncheck-strict=true` means it will fail loudly rather than warn if six findings become five. Found while trying to merge netresearch#795, which is a harden-runner bump that inherited this failure and cannot merge until it clears.
KamilPesek
pushed a commit
to KamilPesek/ofelia
that referenced
this pull request
Aug 19, 2026
`go-check / govulncheck` is failing on every pull request in this repository, and nothing in the tree caused it. ## The findings Six, all in the Go standard library, none in a dependency: | | package | fixed in | |---|---|---| | GO-2026-6218 | `net/url` | go1.26.6 | | GO-2026-6091 | `html/template` | go1.26.6 | | GO-2026-6090 | `crypto/tls` | go1.26.6 | | GO-2026-6089 | `net/http` | go1.26.6 | | GO-2026-5972 | `encoding/asn1` | go1.26.6 | | GO-2026-5026 | `net/http` | go1.26.6 | Each was found reachable — govulncheck's symbol results name real call paths, for example `middlewares/slack.go:118` reaching `url.URL.Parse` through `http.Client.Do`, and `middlewares/mail.go:287` reaching `template.Template.Execute`. So these are not theoretical for this binary. ## The change `go.mod` said `toolchain go1.26.5`. go1.26.6 is the current stable release, checked against `go.dev/dl` rather than assumed. It is the only version pin in the repository — a repo-wide sweep for the old string returns nothing else. The reusable `go-check` workflow resolves its toolchain from `go-version-file`, which defaults to `go.mod`, so this one line is what CI installs. `GOTOOLCHAIN` is set to `local` in the govulncheck step, meaning Go will not silently fetch a different toolchain than the one set up — which is why the `go.mod` line has to be the thing that moves. ## Verification **Not run locally**, and saying so rather than implying otherwise: this is a toolchain bump whose effect only shows under the CI-installed Go. The check that was failing is the one that has to report on this, and `govulncheck-strict=true` means it will fail loudly rather than warn if six findings become five. Found while trying to merge netresearch#795, which is a harden-runner bump that inherited this failure and cannot merge until it clears.
KamilPesek
pushed a commit
to KamilPesek/ofelia
that referenced
this pull request
Aug 19, 2026
…n the github-actions group (netresearch#795) Bumps the github-actions group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner). Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.20.1</h2> <h2>What's Changed</h2> <ul> <li>AWS CodeBuild-hosted runner support</li> <li>Implicitly allow single-labeled (internal) domains in block-mode</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1">https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/b09bb98e06d4d774595224525879c09bc6e98c40"><code>b09bb98</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/680">#680</a> from step-security/aws-code-build</li> <li><a href="https://github.com/step-security/harden-runner/commit/35cd77bcf669054f67ffd3d2802ee54a4f13b5b6"><code>35cd77b</code></a> docs: document the Global Block List in the features list</li> <li><a href="https://github.com/step-security/harden-runner/commit/bb6dbef4bf53876cd2710acd1d36413620d20fb3"><code>bb6dbef</code></a> chore: rebuild dist with clean dependency install</li> <li><a href="https://github.com/step-security/harden-runner/commit/98f73c5a0d2b2cc518e6fb8d973a0a4dde00ba13"><code>98f73c5</code></a> chore: update eBPF agent to v1.8.14</li> <li><a href="https://github.com/step-security/harden-runner/commit/54193c17a4fa3883977217b9afe20378ebe60b19"><code>54193c1</code></a> Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...</li> <li><a href="https://github.com/step-security/harden-runner/commit/d22dd481cea4e96cedde031cfe600c248b592d54"><code>d22dd48</code></a> Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...</li> <li><a href="https://github.com/step-security/harden-runner/commit/0ff09412fb572363b483a3c86ffe52fe61d9fd19"><code>0ff0941</code></a> fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...</li> <li><a href="https://github.com/step-security/harden-runner/commit/a3c333d110c8d95f34488a22e0e56742cfb1b14f"><code>a3c333d</code></a> Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...</li> <li><a href="https://github.com/step-security/harden-runner/commit/bf94c00d6bba2ae7c4a479b86653039811569968"><code>bf94c00</code></a> feat(runners): detect AWS CodeBuild-hosted runners as third-party provider</li> <li><a href="https://github.com/step-security/harden-runner/commit/514522c5e449f9e28fc901f770e08a573d413e67"><code>514522c</code></a> fix(self-hosted): resolve runner user when USER env var is unset</li> <li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...b09bb98e06d4d774595224525879c09bc6e98c40">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 1 update: step-security/harden-runner.
Updates
step-security/harden-runnerfrom 2.20.0 to 2.20.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
b09bb98Merge pull request #680 from step-security/aws-code-build35cd77bdocs: document the Global Block List in the features listbb6dbefchore: rebuild dist with clean dependency install98f73c5chore: update eBPF agent to v1.8.1454193c1Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...d22dd48Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...0ff0941fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...a3c333dRevert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...bf94c00feat(runners): detect AWS CodeBuild-hosted runners as third-party provider514522cfix(self-hosted): resolve runner user when USER env var is unsetDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions