The GitHub Actions job "Tests (AMD)" on airflow.git/ci/go-sdk/dependabot-security-only has succeeded. Run started by GitHub user jason810496 (triggered by jason810496).
Head commit for run: 6a45d355c94fceccb3f86792e1aa4cb1b7f085b8 / LIU ZHE YOU <[email protected]> Limit Dependabot Go module updates to security advisories only The Go SDK's dependencies resolve directly to upstream repositories. Unlike PyPI or npm, there is no central registry that pre-scans a release before it is published, and whoever controls a module's namespace can cut a release at any time. A dangling/hijacked namespace (as recently seen with slogcolor) could therefore land a malicious version through a routine Dependabot bump into contributors' dev environments and CI before anyone reviews it. Disable automatic version-update PRs for the go-sdk gomod ecosystem on the default branch (open-pull-requests-limit: 0) and keep only advisory-driven security updates, which require a published GHSA advisory and cannot be triggered by an upstream release self-declaring itself a security fix. Routine Go dependency bumps are now done manually when needed. Raise the gomod cooldown to 14 days so any release that is auto-considered on the v3-3-test branch has a longer window to be flagged before it is pulled in. Report URL: https://github.com/apache/airflow/actions/runs/30706483009 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
