From 42da61a85ea4a59676a43d77926d3452af23235e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 11:47:57 +0000 Subject: [PATCH] Bump step-security/harden-runner from 2.15.1 to 2.16.0 ## Release notes Sourced from step-security/harden-runner's releases. v2.16.0 What's Changed Updated action.yml to use node24 Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details. Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details. Full Changelog: https://github.com/step-security/harden-runner/compare/v2.15.1...v2.16.0 ## Commits fa2e9d6 Release v2.16.0 (#646) See full diff in compare view ![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] Change-Id: I33ea45204879820af77a8d3647d0664f6053bf78 GitHub-PR: https://github.com/onap/doc/pull/11 GitHub-Hash: b4b8fa11185d1b12 Signed-off-by: onap.gh2gerrit --- .github/workflows/call-github2gerrit.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml index 223a5c6b6..f158db767 100644 --- a/.github/workflows/call-github2gerrit.yaml +++ b/.github/workflows/call-github2gerrit.yaml @@ -94,7 +94,7 @@ jobs: timeout-minutes: 5 steps: # yamllint disable-line rule:line-length - - uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 with: egress-policy: audit @@ -120,7 +120,7 @@ jobs: steps: # Harden the runner used by this workflow # yamllint disable-line rule:line-length - - uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 with: egress-policy: audit @@ -151,7 +151,7 @@ jobs: steps: # Harden the runner used by this workflow # yamllint disable-line rule:line-length - - uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 name: 'Harden runner' with: egress-policy: audit @@ -200,7 +200,7 @@ jobs: steps: # Harden the runner used by this workflow # yamllint disable-line rule:line-length - - uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 + - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 with: egress-policy: audit -- 2.16.6