Bump step-security/harden-runner from 2.15.1 to 2.16.0 21/143621/1
authordependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Mon, 16 Mar 2026 11:47:57 +0000 (11:47 +0000)
committeronap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>
Mon, 16 Mar 2026 11:47:58 +0000 (11:47 +0000)
commit42da61a85ea4a59676a43d77926d3452af23235e
tree216bd0f7253d771fac364c0d28f430d3e304b1ea
parent4716b3500373a5c8cff3ad6c0c4c49739d5a206a
Bump step-security/harden-runner from 2.15.1 to 2.16.0

## Release notes

Sourced from step-security/harden-runner's releases.

v2.16.0
What's Changed

Updated action.yml to use node24
Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.15.1...v2.16.0

## Commits

fa2e9d6 Release v2.16.0 (#646)
See full diff in compare view

![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Issue-ID: CIMAN-33
Signed-off-by: dependabot[bot] <support@github.com>
Change-Id: I33ea45204879820af77a8d3647d0664f6053bf78
GitHub-PR: https://github.com/onap/doc/pull/11
GitHub-Hash: b4b8fa11185d1b12
Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>
.github/workflows/call-github2gerrit.yaml