[dependabot]

Bumps the node-workflow-tools group in /tools/github-workflow-tools with 1 update: @cyclonedx/cdxgen.

Updates @cyclonedx/cdxgen from 12.8.4 to 12.8.5

Release notes

Sourced from @​cyclonedx/cdxgen's releases.

Release v12.8.5

This LTS release fixes a High severity signature verification bypass, tracked as GHSA-7m2v-pj5r-fjww. cdx-verify, cdx-validate --require-signature and the verifyBom library function accepted a BOM whose JSF signature declared an HMAC algorithm and was computed with the signer's public key, so anyone holding the public key could forge a valid signature. The advisory will be published shortly with full details.

Breaking change

Each signature now covers its own algorithm, keyId and publicKey, as the JSF specification requires, and every signature algorithm must match the key type. BOMs signed with 12.8.4 or earlier no longer verify and must be re-signed with this version of cdx-sign, as described in the cdx-sign documentation. HMAC signatures now need the new --secret-key option. cdxgen also exits with an error when signing is configured but fails, instead of writing or uploading an unsigned BOM.

What's Changed

• Bind JSF signature algorithms to key types and require an explicit HMAC secret by @​prabhu in cdxgen/cdxgen#4401
• Patch dependency updates, action pins and types by @​prabhu in cdxgen/cdxgen#4411
• Refresh image digests and tool versions by @​prabhu in cdxgen/cdxgen#4412

Thanks to @​richilino for the report.

Full Changelog: cdxgen/cdxgen@v12.8.4...v12.8.5

Commits

• 46ca32d Merge pull request #4412 from cdxgen/chore/v12-image-versions
• 965ea97 Use SDKMAN identifiers the download broker serves
• 28995b7 Build the ruby 2.6 image now that bullseye is EOL
• ffa5a5a Update .versions and the documented Java tool defaults
• 9630768 Refresh base image digests and tool versions in the Dockerfiles
• bef1ab9 Merge pull request #4411 from cdxgen/chore/v12-release-prep
• 9577283 Regenerate TypeScript declarations
• 864b74d Update pinned GitHub Actions
• fda83fd Update dependencies to their latest patch releases
• 3916dc8 Merge pull request #4401 from cdxgen/fix/jsf-signature-binding-v12
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud