chains-project/maven-lockfile
View on GitHub ↗ ★ 70 Java
Lockfiles for Maven. Pin your dependencies. Build with integrity.
3 mentions on Hacker News by 3 people: 0 stories, 3 comments · first 2025-03-15 · latest 2025-03-16
20082026
-
…to a sha was not sufficient; the Renovate bot was updating actions referenced by sha. Example: https://github.com/chains-project/maven-lockfile/pull/1111/f... This appears to be governed by the `pinGitHubActionDigests` helper configured in…
comment by bboreham · 2025-03-16 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos -
heh, timing is everything https://github.com/chains-project/maven-lockfile/issues/1085... > After some cleanup the changed-files ( https://github.com/tj-actions/changed-files ) action seems to be more work to remove. It would be awesome if…
comment by mdaniel · 2025-03-15 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos -
…the exfiltration commit from the fake renovate bot and started auto-merging it into other projects: https://github.com/chains-project/maven-lockfile/pull/1111
comment by themgt · 2025-03-15 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos