Conversation
Bumps [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) from 7.1.0 to 8.0.0. - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@299e4b7...59db25f) --- updated-dependencies: - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
LGTM. The repo-side diff is just the SHA + version bump, but flagging what the verify workflow's "Source diff vs approved" surfaces, since v7.1.0 → v8.0.0 spans 9 upstream commits / 49 files and the diff looks alarmingly large at first glance.
Most of the bulk comes from v7.2.0, not from the v8.0.0 breaking change itself:
1. OpenPGP signature verification feature (v7.2.0)
- New
src/main/gpg-verification.js(240 lines) + tests (~700 lines) - Wired into
install-sonar-scanner.js/run-sonar-scanner.js
2. Library upgrades + bundle reorganization (v7.2.0)
dist/index.jsre-bundled (+3950 / −2399)- Two new code-split chunks:
dist/core-DpWEmnbG.js(~30k lines) anddist/exec-zlpfwmpH.js(~32k lines) — that's bundledundicibeing split out. TheBalancedPool/FastTimer/IMFDaysstrings showing up in the verify log are undici internals, not Sonar code. rollup.config.jsupdated to enable the code-split
3. "Migrate to dateless license headers" (v7.2.0)
- Adds an 18-line GNU LGPL header block to ~15 files. Explains why files like
test/example-project/src/main.js(a "Hello World") show +18 lines with no real logic change.
4. Misc CI/infra (v7.2.0) — Node version bump in UTs, dependabot cooldown, Vault token for SubmitReview. Mechanical.
5. v8.0.0 itself — one-line behavior flip: skipSignatureVerification default true → false. README updated with opt-out.
Verifying mitigations:
- ✅ verify workflow's "JS build verification" passed → the giant
dist/chunks are the genuine output ofrollupover the source tree, not injected. - ✅ Lock file present.
Two things genuinely worth a closer look:
src/main/gpg-verification.js— new security-relevant code path (worth eyeballing once)- Behavior change in v8.0.0: signature verification is now ON by default. Consumers who relied on the old default and whose CI can't reach the keyserver will now fail. This is the more secure default; just calling it out.
|
Reviewed both - with agent and eyeballing the changes.. Looks good. |
potiuk
deleted the
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/SonarSource/sonarqube-scan-action-8.0.0
branch
1 participant
Bumps SonarSource/sonarqube-scan-action from 7.1.0 to 8.0.0.
Release notes
Sourced from SonarSource/sonarqube-scan-action's releases.
Commits
59db25fSQSCANGHA-145 Set skipSignatureVerification default value to false (#241)ca30b65SQSCANGHA-143 SubmitReview: Use Vault token (#238)c7ee0f9SQSCANGHA-140 Set skipSignatureVerification default value to true to avoid br...55e4480SQSCANGHA-140 Add OpenPGP signature verification for scanner downloads (#235)30dbe5cSQSCANGHA-138 Update dist and add ci test (#233)c835722SQSCANGHA-134 Upgrade the libraries to latest version (#227)f00de44SC-45750 Migrate to dateless license headers (#229)f099b44SQSCANGHA-133 Upgrade the Node version used in UTs + contribution guide (#226)d899ed2BUILD-10861 Dependabot 5-day cooldown + internal excludes (#225)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)