chore(deps): update dependency @cyclonedx/cdxgen to v11.1.7 #661
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
🏆 No vulnerabilities found |
heubeck
force-pushed
the
renovate/cyclonedx-cdxgen-11.x
branch
from
74f7134 to
57bfa1c
Compare
heubeck
changed the title
beiertu-mms
approved these changes
Feb 3, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.1.5->11.1.7Release Notes
CycloneDX/cdxgen (@cyclonedx/cdxgen)
v11.1.7Compare Source
cdxgen (>= v11.1.7) now includes a "secure mode," powered by the Node.js permission model. This "seat-belt approach" allows you to control which system resources cdxgen can access and what actions it can perform with those resources. For example, in
--lifecycle pre-buildmode, you can restrict cdxgen to reading only specific files, without granting permission to execute child processes. Even when executing node-based commands such as npm or atom, you can further limit the directories these external commands can read and write, as well as their permissions to execute child processes. This makes cdxgen an ideal SBOM tool when dealing with untrusted codebases (which is all software).For further information, please refer to the permissions documentation or start using the new
ghcr.io/cyclonedx/cdxgen-securecontainer image.Thank you to @eran-medan and the other security researchers for helping bring this feature live.
Addresses CVE-2024-50611 and #1328. Please update at your convenience.
Full Changelog: CycloneDX/cdxgen@v11.1.6...v11.1.7
v11.1.6Compare Source
What's Changed
Other Changes
Full Changelog: CycloneDX/cdxgen@v11.1.5...v11.1.6
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.