[dependabot]

Bumps lachaib/lockscan from 0.1 to 0.3.

Release notes

Sourced from lachaib/lockscan's releases.

v0.3.0

Features

• Severity in the JSON report: severity and a stable rule id on every pattern and binary delta finding, per-package maxSeverity, and summary.maxSeverity, summary.bySeverity and summary.findingsBySeverity. All fields are additive; label is unchanged (#23, #28).
• Binary evidence files: with artifacts-dir, flagged binaries get capped .lockscan-strings.txt and .lockscan-imports.txt files, referenced from the finding as evidence (#25, #30).

Fixes

• Fewer binary false positives: binary:base64 ignores data tables and pure-hex runs, and binaries are paired across versions ignoring a leading build hash (#24, #29).
• Fewer Python pattern false positives: comments, docstrings and string contents are ignored, and exec:eval/exec/compile match the builtin only. ddtrace 4.15.6: 626 → 137 hits (#22, #31).
• Release check: 6.6 now matches an upstream v6.6.0 tag (#26, #27).

Dependencies

• adm-zip 0.5.17 → 0.6.1 (fixes several advisories for untrusted ZIPs), tar 7.5.22, lockdelta 0.1.10 (#32).

v0.2.1

Security

• Archive symlinks: tarball extraction no longer creates symlink or hardlink entries, and zip/wheel extractors skip symlink entries. A package could ship a file as a symlink to a sensitive path (e.g. /proc/self/environ) and make lockscan, or a later step using artifacts-dir, read it (#20, #21).
• New findings archive:symlink-escape (high) and archive:symlink (moderate) report such links with their target.

v0.2.0

Features

• json-to-file: write the full JSON report (identical to the report output) to a file, creating parent directories, so large reports avoid env-var and output size limits (#16, #18).
• artifacts-dir: keep extracted artifacts in a lockscan-* subdirectory for the rest of the job, exposed as the artifacts-path output and removed by a post step even on failure (#17, #19).

v0.1.7

Features

• Code-signature regressions: flag native binaries whose Developer ID (Mach-O) or Authenticode (PE) signature was dropped or changed signer between versions (#13, #14). Extensionless executables and .exe files are now scanned too.
• Build provenance regressions: flag dropped or changed build attestations on npm (SLSA/Sigstore), PyPI (PEP 740) and JSR (#13, #14). New provenanceRegressions summary counter.

Chore

• Fix Biome template, unused-code and stale suppression warnings (#15)

v0.1.6

What's Changed

• feat(cli): add --quiet flag to suppress progress logs by @​lachaib in lachaib/lockscan#12

Full Changelog: lachaib/lockscan@v0.1.5...v0.1.6

v0.1.5

What's Changed

• chore: migrate pnpm from 11.0.9 to 12.2.1 by @​vincentbasp in lachaib/lockscan#10

New Contributors

• @​vincentbasp made their first contribution in lachaib/lockscan#10

Full Changelog: lachaib/lockscan@v0.1.4...v0.1.5

v0.1.4

What's Changed

• fix(registry-check): require corroboration for round-version confusion signal by @​lachaib in lachaib/lockscan#9

... (truncated)

Commits

• 00e712c Merge pull request #32 from lachaib/lockscan:chore/deps-refresh
• 140d75a chore(deps): bump adm-zip to 0.6.1, tar and lockdelta; drop @​types/adm-zip
• 7ba1d74 Merge pull request #31 from lachaib/lockscan:fix/pattern-noise
• 65f6c4f fix(python): ignore comments, docstrings and string literals in pattern scan ...
• 751f1ad Merge pull request #30 from lachaib/lockscan:feat/binary-evidence
• 977dad1 feat(binary-scan): write strings and imports evidence files for flagged binar...
• 0be0445 Merge pull request #29 from lachaib/lockscan:fix/binary-noise
• 4bac2c9 fix(binary-scan): ignore non-base64 data tables and pair hash-prefixed binari...
• a19bda1 Merge pull request #28 from lachaib/lockscan:feat/json-severity
• 9fc32c7 feat(report): add per-finding severity, rule ids and severity summary to the ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)