From be7e0a7e517ea59da34321814d1a19de36f7184f Mon Sep 17 00:00:00 2001 From: William <236412244+william-u10d@users.noreply.github.com> Date: Thu, 3 Sep 2026 07:12:32 -0700 Subject: [PATCH] chore(deps): bump SocketDev/socket-basics to v3.1.0 Bumps the pinned digest from 6b71cdf (v3.0.0) to 5b615c8 (v3.1.0). v3.1.0 is a minor, backwards-compatible release. Notable fixes relevant to how this workflow invokes the action: - changed_files resolved to zero files inside the Docker container action because of a git dubious-ownership error (SocketDev/socket-basics#105) - changed_files was not honored from every config source, and failed silently when it was not (SocketDev/socket-basics#98) Both bugs could cause the scan to silently cover no files, so this is a correctness fix for PR-scoped scanning, not just a version refresh. Digest verified against the v3.1.0 tag via the GitHub API. --- .github/workflows/security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 197c953..ba486b4 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -38,7 +38,7 @@ jobs: # App instead (server-side auth, no key in the Actions context). This # keeps the API key on trusted, same-repo events only. if: github.event.pull_request.head.repo.full_name == github.repository - uses: SocketDev/socket-basics@6b71cdf3f792e1ba15b0c42133d8a6f29fb1fc4f # v3.0.0 + uses: SocketDev/socket-basics@5b615c89d17764ab46de2f2de63122ca2ef6a4be # v3.1.0 continue-on-error: true env: GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}