Skip to content

build(deps): bump github.com/mikefarah/yq/v4 from 4.53.2 to 4.53.3 in /aws-cli#933

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/aws-cli/github.com/mikefarah/yq/v4-4.53.3
Jun 15, 2026
Merged

build(deps): bump github.com/mikefarah/yq/v4 from 4.53.2 to 4.53.3 in /aws-cli#933
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/aws-cli/github.com/mikefarah/yq/v4-4.53.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/mikefarah/yq/v4 from 4.53.2 to 4.53.3.

Release notes

Sourced from github.com/mikefarah/yq/v4's releases.

v4.53.3

Changelog

Sourced from github.com/mikefarah/yq/v4's changelog.

4.53.3:

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq) from 4.53.2 to 4.53.3.
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@v4.53.2...v4.53.3)

---
updated-dependencies:
- dependency-name: github.com/mikefarah/yq/v4
  dependency-version: 4.53.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 15, 2026
@github-actions github-actions Bot added the build [Conventional Commits] Changes that affect the build system or external dependencies label Jun 15, 2026
@github-actions github-actions Bot enabled auto-merge (squash) June 15, 2026 13:46
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

aws-cli/go.mod

PackageVersionLicenseIssue Type
golang.org/x/net0.55.0NullUnknown License
golang.org/x/sys0.45.0NullUnknown License
Allowed Licenses: 0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, CC0-1.0, MIT, MIT-0

OpenSSF Scorecard

PackageVersionScoreDetails
gomod/github.com/mikefarah/yq/v4 4.53.3 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 3/25 approved changesets -- score normalized to 1
Dependency-Update-Tool🟢 10update tool detected
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 109 out of 9 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 20 contributing companies or organizations
gomod/golang.org/x/net 0.55.0 UnknownUnknown
gomod/golang.org/x/sys 0.45.0 UnknownUnknown

Scanned Files

  • aws-cli/go.mod

@github-actions github-actions Bot merged commit 623f9af into main Jun 15, 2026
55 checks passed
@github-actions github-actions Bot deleted the dependabot/go_modules/aws-cli/github.com/mikefarah/yq/v4-4.53.3 branch June 15, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build [Conventional Commits] Changes that affect the build system or external dependencies dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants