You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@opendal.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/08/25 12:22:42 UTC
[PR] build(deps): bump 1Password/load-secrets-action from 4.1.1 to 5.0.1 [opendal-reqsign]
dependabot[bot] opened a new pull request, #852:
URL: https://github.com/apache/opendal-reqsign/pull/852
Bumps [1Password/load-secrets-action](https://github.com/1password/load-secrets-action) from 4.1.1 to 5.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/1password/load-secrets-action/releases">1Password/load-secrets-action's releases</a>.</em></p>
<blockquote>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<h3>Fixes</h3>
<ul>
<li>Correct the authentication error message. It previously listed only the CLI methods (<code>OP_SERVICE_ACCOUNT_TOKEN</code>, or <code>OP_CONNECT_HOST</code> + <code>OP_CONNECT_TOKEN</code>), which misled anyone who meant to use Workload Identity but had one of those variables missing or misspelled. It now lists <code>OP_WORKLOAD_ID</code> + <code>OP_ENVIRONMENT_ID</code> + <code>OP_INTEGRATION_KEY</code> as a third valid option. (<a href="https://redirect.github.com/1password/load-secrets-action/issues/187">#187</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Bump <code>@1password/sdk</code> from <code>0.5.0-beta.1</code> to the stable <code>0.5.0</code>, and rebuild <code>dist/</code> (including <code>core_bg.wasm</code>). (<a href="https://redirect.github.com/1password/load-secrets-action/issues/187">#187</a>)</li>
<li>Update the baked-in beta CLI fallback version: <code>2.38.1-beta.02</code> → <code>2.39.0-beta.02</code>.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Harden CI: add the StepSecurity harden-runner and pin GitHub Actions to commit SHAs across the E2E and fallback-version workflows, and restrict workflow permissions. (<a href="https://redirect.github.com/1password/load-secrets-action/issues/182">#182</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/1Password/load-secrets-action/compare/v5.0.0...v5.0.1">https://github.com/1Password/load-secrets-action/compare/v5.0.0...v5.0.1</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<h3>Features</h3>
<ul>
<li>Add Workload Identity authentication using the GitHub Actions OIDC token (public preview). (<a href="https://redirect.github.com/1password/load-secrets-action/issues/169">#169</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/1Password/load-secrets-action/compare/v4.1.1...v5.0.0">https://github.com/1Password/load-secrets-action/compare/v4.1.1...v5.0.0</a></p>
<h2>v5.0.0-beta.1</h2>
<h2>What's Changed</h2>
<h3>Feature</h3>
<ul>
<li>Add Workload Identity authentication using the GitHub Actions OIDC token (private beta) (<a href="https://redirect.github.com/1Password/load-secrets-action/pull/169">#169</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/1Password/load-secrets-action/compare/v4.0.0...v5.0.0-beta.1">https://github.com/1Password/load-secrets-action/compare/v4.0.0...v5.0.0-beta.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/1Password/load-secrets-action/commit/70062d7a876d3eb6334754fa26efd2fbd90c32f2"><code>70062d7</code></a> Merge pull request <a href="https://redirect.github.com/1password/load-secrets-action/issues/190">#190</a> from 1Password/release/v5.0.1</li>
<li><a href="https://github.com/1Password/load-secrets-action/commit/6f5bd0ee534cf837bfa1f87ea2845aec1549d969"><code>6f5bd0e</code></a> Prepare Release 5.0.1</li>
<li><a href="https://github.com/1Password/load-secrets-action/commit/846abe067a096b604798cbf52d62328922142eb3"><code>846abe0</code></a> Merge pull request <a href="https://redirect.github.com/1password/load-secrets-action/issues/187">#187</a> from 1Password/jill/bump-to-stable-sdk</li>
<li><a href="https://github.com/1Password/load-secrets-action/commit/557708fd563fb71e25c7bd961d11c0ca93970072"><code>557708f</code></a> Bump sdk type</li>
<li><a href="https://github.com/1Password/load-secrets-action/commit/2d8a25ce9566884d7eb34769a8a3a32031d3ff42"><code>2d8a25c</code></a> Merge pull request <a href="https://redirect.github.com/1password/load-secrets-action/issues/182">#182</a> from 1Password/chore/GHA-211518-stepsecurity-remediation</li>
<li><a href="https://github.com/1Password/load-secrets-action/commit/e544b780808654ba8ceba5fb2fe2897103d92ff4"><code>e544b78</code></a> Prepare Release v5.0.0 (<a href="https://redirect.github.com/1password/load-secrets-action/issues/185">#185</a>)</li>
<li><a href="https://github.com/1Password/load-secrets-action/commit/631992c4a12d3c60fd97d3c2dfbe51047a8b7fba"><code>631992c</code></a> Apply GitHub Actions security best practices</li>
<li>See full diff in <a href="https://github.com/1password/load-secrets-action/compare/eb2efd0703da22a93c467f2d1ffbb6826c11e19c...70062d7a876d3eb6334754fa26efd2fbd90c32f2">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] build(deps): bump 1Password/load-secrets-action from 4.1.1 to 5.0.1 [reqsign]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo merged PR #852:
URL: https://github.com/apache/reqsign/pull/852
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org