Update snyk/actions action to v0.5.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
snyk/actions	action	minor	0.3.0 → v0.5.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

snyk/actions (snyk/actions)

v0.5.0

Compare Source

What's Changed

• feat: add ability for customer to specify custom docker image by @​nathan-roys in #​122
• Revert "feat: add ability for customer to specify custom docker image" by @​nathan-roys in #​123
• feat: add actions for maven jdk 17 and 20 by @​bmvermeer in #​124
• feat: add actions for maven jdk 17 and 20 by @​bmvermeer in #​125
• chore: secrets scanning by @​dragos-cojocari in #​127
• chore: remove unused Dockerfile by @​dragos-cojocari in #​128
• Add contributing.md and code of conduct by @​torgo in #​126
• chore: asset classification by @​dragos-cojocari in #​130
• fix: add safe directory to git, change creds for generation by @​bastiandoetsch in #​131
• chore: update codeowners with new team identifer (@​snyk/cli) by @​thisislawatts in #​136
• feat: re-org labels and security gates by @​bikochan in #​137
• feat: add actions for maven jdk 21 and 22 by @​bmvermeer in #​138
• fix: add fallback set up command using the env variable by @​bastiandoetsch in #​140
• Revert "fix: add fallback set up command using the env variable" by @​bastiandoetsch in #​141
• fix: add test & env variable for setup by @​bastiandoetsch in #​142
• fix: In setup action check if sudo is available by @​PeterSchafer in #​143
• feat(scalaSBT): add new Scala SBT action [CLI-382] by @​j-luong in #​144
• feat: add alpine support by @​PeterSchafer in #​145
• feat: change downloadurl and add fallback on setup action by @​sandor-trombitas in #​146
• revert "feat: change downloadurl and add fallback on setup action by @​j-luong in #​147
• feat: change downloadurl and add fallback on setup action by @​j-luong in #​148
• chore: add better logging to setup action script by @​j-luong in #​153
• Update README.md by @​azamat-aminov in #​152
• Mitigate script injection attack in snyk/actions/setup by @​fabasoad in #​157
• Bump gitleaks pre-commit hook from 8.17.0 to 8.27.2 by @​fabasoad in #​158
• chore: adding PR housekeeping by @​dotkas in #​161
• Housekeeping: Fixing broken synchronization script by @​dotkas in #​162
• fix: synchronizing Github actions templates by @​team-cli-bot in #​164
• Housekeeping: Updating Ruby script, fixing more typos by @​dotkas in #​165
• fix: synchronizing Github actions templates by @​team-cli-bot in #​167
• feat: adding Gradle JDK 21 by @​dotkas in #​168
• feat: adding Python 3.11 by @​dotkas in #​169
• chore: update codeowners [CLI-1037] by @​prodsec-github-automation in #​173
• chore: adding warnings to generated files by @​dotkas in #​178
• fix: synchronizing Github actions templates by @​team-cli-bot in #​180
• feat: adding elixir to actions by @​dotkas in #​170
• fix: automatically deprecate actions from deprecated snyk images by @​dotkas in #​182
• fix: synchronize actions with the snyk-images repository by @​team-cli-bot in #​187
• chore: adding deprecation warning to READMEs as well by @​dotkas in #​188
• fix: synchronizing Github actions templates by @​team-cli-bot in #​189
• fix: adding generated action tests by @​dotkas in #​181
• fix: adding new actions, deprecating some gradle by @​dotkas in #​190
• fix: synchronize actions with the snyk-images repository by @​team-cli-bot in #​193
• docs: add contributing and support sections by @​thisislawatts in #​194
• fix: synchronizing Github actions templates by @​team-cli-bot in #​195
• chore: add security.md [PRODSEC-5886] by @​cvaidas in #​197
• fix: update upload-sarif documentation by @​dotkas in #​196
• chore(ci): generate GitHub releases based on commits by @​thisislawatts in #​198
• chore(ci): intentionally empty commit to trigger release by @​thisislawatts in #​199

New Contributors

• @​nathan-roys made their first contribution in #​122
• @​bmvermeer made their first contribution in #​124
• @​dragos-cojocari made their first contribution in #​127
• @​torgo made their first contribution in #​126
• @​thisislawatts made their first contribution in #​136
• @​bikochan made their first contribution in #​137
• @​PeterSchafer made their first contribution in #​143
• @​j-luong made their first contribution in #​144
• @​sandor-trombitas made their first contribution in #​146
• @​azamat-aminov made their first contribution in #​152
• @​fabasoad made their first contribution in #​157
• @​dotkas made their first contribution in #​161
• @​team-cli-bot made their first contribution in #​164
• @​prodsec-github-automation made their first contribution in #​173
• @​cvaidas made their first contribution in #​197

Full Changelog: snyk/actions@0.4.0...v0.5.0

v0.4.0

Compare Source

What's Changed

• Fixed typo on iac readme.md by @​benlaplanche in #​29
• updated the templates with UTMs! by @​tomgonzo in #​33
• Include attribution by @​mattcreager in #​41
• Add python-3.8 variant by @​JackuB in #​45
• Update README.md - fix a typo by @​jsynowiec in #​49
• Document SARIF options for Snyk test by @​JackuB in #​48
• Add a Python 3.6 variant action by @​garethr in #​56
• Adding a Python 3.7 action by @​garethr in #​57
• docs: use monitor command for the monitor step by @​lirantal in #​59
• feat: add gradle-jdk14 action by @​gitphill in #​61
• feat: add Gradle-jdk16 by @​muscar in #​62
• Update README.md to refer to IAC action vs Docker Action by @​subsy in #​69
• Update README.md by @​zbraiterman in #​71
• Fix typo by @​subsy in #​70
• Updated the Snyk IaC Readme to show a directory scan by @​benlaplanche in #​55
• chore: update codeowners in #​81
• chore: cleanup project directory after download and move by @​attriaayush in #​83
• adds examples for Snyk Org and multiple files for IaC by @​ksatirli in #​82
• Issue #​85 - Prevent unintentional file deletion by @​WillBartee in #​86
• Update README.md by @​EC-Snyk in #​95
• feat: add color to github actions output by @​kevin-s31 in #​94
• Add Gradle JDK 17 support by @​jpJuni0r in #​100
• Upgrade CodeQL Action from v1 to v2 by @​karimhabush in #​96
• Fixes dead links in READMEs by @​Aleksander-Karlsson in #​103
• Updating the Python Snyk Action README(s) with dependency installation information by @​akanchhaS in #​104
• Updating the python change in README template by @​akanchhaS in #​105
• chore: download from static.snyk.io by @​bastiandoetsch in #​108
• httpS by @​YuuyaSatsuki in #​39
• chore: have CI badge link to build by @​jackwotherspoon in #​101
• Add example to make gradle-jdk17 action compatible with actions/set-up-java by @​ibaiul in #​109
• fix: refined iac test action readme [CFG-1631] by @​ofekatr in #​112
• add python 3.9, 3.10 by @​Inveracity in #​111
• chore: fix workflow by @​bastiandoetsch in #​114
• Update CODEOWNERS by @​asaf92 in #​117
• Replace deprecated set-output with GITHUB_OUTPUT by @​pergardebrink in #​110
• chore: use curl and compression for cli download by @​bastiandoetsch in #​120

New Contributors

• @​tomgonzo made their first contribution in #​33
• @​mattcreager made their first contribution in #​41
• @​JackuB made their first contribution in #​45
• @​jsynowiec made their first contribution in #​49
• @​gitphill made their first contribution in #​61
• @​muscar made their first contribution in #​62
• @​subsy made their first contribution in #​69
• @​zbraiterman made their first contribution in #​71
• @​attriaayush made their first contribution in #​83
• @​ksatirli made their first contribution in #​82
• @​WillBartee made their first contribution in #​86
• @​EC-Snyk made their first contribution in #​95
• @​kevin-s31 made their first contribution in #​94
• @​jpJuni0r made their first contribution in #​100
• @​karimhabush made their first contribution in #​96
• @​Aleksander-Karlsson made their first contribution in #​103
• @​akanchhaS made their first contribution in #​104
• @​bastiandoetsch made their first contribution in #​108
• @​YuuyaSatsuki made their first contribution in #​39
• @​jackwotherspoon made their first contribution in #​101
• @​ibaiul made their first contribution in #​109
• @​ofekatr made their first contribution in #​112
• @​Inveracity made their first contribution in #​111
• @​asaf92 made their first contribution in #​117
• @​pergardebrink made their first contribution in #​110

Full Changelog: snyk/actions@0.3.0...0.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[secure-code-warrior-for-github]

Micro-Learning Topic: Injection attack (Detected by phrase)

Matched on "injection attack"

Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Try a challenge in Secure Code Warrior

Helpful references

• OWASP Top Ten 2021 A03: Injection - OWASP Top Ten articles provide basic techniques to protect against these high risk problem areas, and guidance on where to go next.
• OWASP Injection Prevention Cheat Sheet in Java - This article is focused on providing clear, simple, actionable guidance for preventing injection flaws in your Java applications.
• OWASP Input Validation Cheat Sheet - This cheatsheet is focused on providing clear, simple, actionable guidance for preventing injection and input validation flaws in your applications.
• OWASP Injection Prevention Cheat Sheet - This article is focused on providing clear, simple, actionable guidance for preventing injection flaws in your applications.
• OWASP Top Ten Proactive Controls 2018 C5: Validate All Inputs - Detailed article on input validation as a programming technique for ensuring that only properly formatted data may enter a software system component.

Micro-Learning Topic: Cross-site scripting (Detected by phrase)

Matched on "script injection"

Cross-site scripting vulnerabilities occur when unescaped input is rendered into a page displayed to the user. When HTML or script is included in the input, it will be processed by a user's browser as HTML or script and can alter the appearance of the page or execute malicious scripts in their user context.

Try a challenge in Secure Code Warrior

Helpful references

• Prevent Cross-Site Scripting (XSS) in ASP.NET Core - A detailed Microsoft article on how to prevent cross-site scripting in ASP.NET Core.
• OWASP Cross Site Scripting (XSS) Software Attack - OWASP community page with comprehensive information about cross site scripting, and links to various OWASP resources to help detect or prevent it.
• OWASP Cross Site Scripting Prevention Cheat Sheet - This article provides a simple positive model for preventing XSS using output encoding properly.

[performance-testing-bot]

Unable to locate .performanceTestingBot config file

[difflens]

View changes in DiffLens

[AdamOswald]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	dlib@​20.0.1
	grpcio@​1.80.0
	igraph@​1.0.0
	pip@​26.1
	pipenv@​2026.5.2
	kornia@​0.8.2
	paddlenlp@​2.8.1
	numba@​0.65.1
	filterpy@​1.4.5
	dill@​0.4.1
	psutil@​7.2.2
	einops@​0.8.2
	aiohttp@​3.13.5
	paddlefsl@​1.1.0
	paddle2onnx@​2.1.0
	jedi@​0.19.2
	clip-anytorch@​2.6.0
	lpips@​0.1.4
	markupsafe@​3.0.3
	omegaconf@​2.3.0

View full report