Bump bjcorder/deterministic-deps from 6076e4b0edc592d8f09b8984bf504b8709eb6b4f to 590b60e05138c3a56918f66078cb8759646c7cae

[dependabot]

Bumps bjcorder/deterministic-deps from 6076e4b0edc592d8f09b8984bf504b8709eb6b4f to 590b60e05138c3a56918f66078cb8759646c7cae.

Changelog

Sourced from bjcorder/deterministic-deps's changelog.

Changelog

All notable changes to this project will be documented in this file.

Unreleased

• Fixed Rust git dependency scanning so per-package dependency subtables and Cargo patch/replace override sections cannot bypass the rust/git-rev-sha rule.
• Bounded opt-in remote validation to 100 unique remote references per scan and report overflow refs as low-severity validation errors instead of silently skipping them.

1.1.0 - 2026-05-13

• Added a GitHub Actions runner-label rule that flags floating hosted labels such as ubuntu-latest, windows-latest, and macos-latest.
• Added Rust toolchain file checks for floating stable, beta, and nightly channels.
• Redacted credential-bearing dependency strings from findings, reports, SARIF, and annotations.
• Restricted remote-validation GITHUB_TOKEN forwarding to trusted HTTPS GitHub API hosts, with remote-token-policy: never for fully unauthenticated remote validation.
• Reduced GitHub Actions token permissions for CI and CodeQL workflows.
• Added explicit vulnerability reporting links to the security policy.
• Documented intentional floating Dockerfile fixtures and the Scorecard test-fixture dismissal rationale.
• Removed vulnerable real package names from parser fixtures to reduce security alert noise.
• Polished post-release docs with canonical Marketplace, release, install, and schema links.
• Improved early v1 feedback intake and maintainer triage guidance for false positives, confusing findings, and setup friction.
• Upgraded @actions/core to 3.0.1 and verified the bundled Node 24 action output continues to run through the committed CommonJS dist/index.js artifact.
• Future versions of deterministic-deps are licensed under AGPL-3.0-only. Previous MIT-licensed releases remain available under their original terms.

1.0.0 - 2026-05-03

• Published the v1 GitHub Action interface for advisory and enforce modes.
• Set package and action metadata for the stable Marketplace v1.0.0 release.
• Supported static dependency determinism checks for GitHub Actions, container files, Terraform/OpenTofu, Node.js, Python, Go, Rust, JVM, and Ruby.
• Added Markdown reports, SARIF reports for code scanning, count outputs, and optional patch output for conservative safe exact-line remediation suggestions.
• Added parser-backed checks for GitHub Actions workflows, Compose files, devcontainer JSON, Terraform/OpenTofu blocks, Node manifests and lockfiles, Python requirements/project files, Go modules, Rust manifests, Gemfiles, and Maven/Gradle files.
• Added .deterministic-deps.yml configuration with rule toggles, severity overrides, allowlists, include/exclude patterns, ecosystem options, and a machine-readable JSON Schema.
• Added diagnostics for malformed config, invalid config fields, and invalid direct action inputs with deterministic fallback behavior.
• Added opt-in remote validation for pinned GitHub commit refs with bounded timeout/retry behavior.
• Added GitHub Enterprise Server URL handling for opt-in remote validation through GitHub Actions GITHUB_API_URL and GITHUB_SERVER_URL environment variables.
• Added enriched SARIF metadata, rule documentation links, default severity metadata, and stable partial fingerprints for code scanning alerts.

... (truncated)

Commits

• 590b60e feat: pilot Ozark internal stdlib — runtime deps through osl-* forks (#106)
• 71c10f2 fix: detect multiline ruby git dependencies (#98)
• bee7222 fix: reject unsafe patch replacement paths (#105)
• caa1de3 fix: bound remote validation fan-out and clamp remote timeout/retries (#104)
• 181c9ff docs: pin enforce examples to immutable action SHAs (#103)
• 28e1b3d fix: require exact node git commit refs (#101)
• 5b3d944 fix: catch Rust git dependency subtables (#99)
• 0844212 fix: preserve config policy defaults (#96)
• 0f5ca30 Security defense-in-depth, config simplification, expanded tests (#91)
• 6f17c6b docs: add branded README header (#97)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)