build(deps): bump dawidd6/action-send-mail from 3.12.0 to 18 in the github-actions group - #118
Conversation
Bumps the github-actions group with 1 update: [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail). Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) --- updated-dependencies: - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The proposed update transitions the dawidd6/action-send-mail action from version 3.12.0 to v18. While Codacy indicates the PR is up to standards, the significant jump across fifteen major versions introduces a high risk of breaking changes in the underlying input parameters. There is no evidence in the PR that the existing SMTP configuration has been verified against the new version's specifications.
A high-severity security issue exists because the action is pinned to a mutable tag rather than a specific commit SHA. This practice leaves the workflow vulnerable to supply chain attacks if the tag is ever reassigned to a different commit. This security risk should be addressed by pinning the action to a full-length commit SHA before merging.
About this PR
- The jump from version 3 to 18 is substantial. Please ensure that all SMTP configuration parameters (server_address, server_port, secure, etc.) remain compatible with the latest version, as major version updates often introduce breaking changes to input schemas.
Test suggestions
- Verify the workflow file correctly references the target tag for the send-mail action.
- Verify that the SMTP configuration parameters (server_address, server_port, secure, username, password, from, to, subject, body) remain functional and compatible with the new major version.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the SMTP configuration parameters (server_address, server_port, secure, username, password, from, to, subject, body) remain functional and compatible with the new major version.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
There was a problem hiding this comment.
🔴 HIGH RISK
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a specific SHA ensures the workflow executes verified code and protects against potential tag-based supply chain vulnerabilities.
|
1 participant
Bumps the github-actions group with 1 update: dawidd6/action-send-mail.
Updates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions