github-actions released this 15 Jun 20:41

Immutable release. Only release title and notes can be modified.

v0.5.36

8552c68

This commit was created on GitHub.com and signed with GitHub’s verified signature.

GPG key ID: B5690EEEBB952194

Verified

Learn about vigilant mode.

[ENG-7840](https://stacklet.atlassian.net/browse/ENG-7840)

What
----

- Add release note sections for 0.5.35 (got skipped) and 0.5.36
(pending)
- Document the CVE dependency upgrades (0.5.35) and the c7n/c7n-left
upgrades (0.5.36)
- Add a generalized supply-chain hardening note for customers
- Omit internal-only changes that are not user-facing

Why
---

- The NEWS file was missing sections for the 0.5.35 and 0.5.36 releases

Testing
-------

N/A (documentation only)

Docs
----

`NEWS.md` updated


[ENG-7840]:
https://stacklet.atlassian.net/browse/ENG-7840?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

github-actions released this 15 Jun 20:12

Immutable release. Only release title and notes can be modified.

v0.5.35

11eed05

This commit was created on GitHub.com and signed with GitHub’s verified signature.

GPG key ID: B5690EEEBB952194

Verified

Learn about vigilant mode.

### what

- Upgraded all dependencies via `uv lock --upgrade` to pull in
  CVE fixes
- Removed `requirements.txt` and its generation hook from
  `.pre-commit-config.yaml` now that Dependabot parses `uv.lock`
  natively
- Added `zizmor` to `.pre-commit-config.yaml` as a pre-commit hook
- Fixed all `zizmor` findings in CI/release workflows:
  - Added `persist-credentials: false` to all `actions/checkout`
    steps (artipacked)
  - Added explicit `permissions: contents: read` at workflow and
    job level where missing (excessive-permissions)
  - Replaced `${{ github.ref_name }}` inline in a `run:` block
    with an `env` variable to prevent template injection
    (template-injection)

### why

CVE fixes in transitive dependencies. Dependabot now supports
`uv.lock` directly, making the generated `requirements.txt`
redundant. `zizmor` is added to pre-commit to catch GitHub Actions
security issues early. The workflow fixes address the security
findings `zizmor` surfaced.

### testing

`zizmor .` reports no findings. Pre-commit hooks pass.

### docs

No documentation changes required.

---------------------------

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Tim Van Steenburgh <tvansteenburgh@gmail.com>

github-actions released this 13 Feb 14:34

v0.5.33

b344a02

This commit was created on GitHub.com and signed with GitHub’s verified signature.

GPG key ID: B5690EEEBB952194

Verified

Learn about vigilant mode.

[ENG-5821](https://stacklet.atlassian.net/browse/ENG-5821)

### what

Upgrade to c7n 0.9.47

### why

Forward.  Always.

### testing

- [x] Unit tests

### docs

N/A


[ENG-5821]:
https://stacklet.atlassian.net/browse/ENG-5821?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

github-actions released this 26 Aug 13:28

v0.5.32

696bf53

This commit was created on GitHub.com and signed with GitHub’s verified signature.

GPG key ID: B5690EEEBB952194

Verified

Learn about vigilant mode.

### what

Update codecov-cli version

### why

This fixes a security vulnerability in one of its dependencies (by
removing the dependency).

### testing

Unit tests

### docs

N/A