[dependabot]

Bumps oasdiff/oasdiff-action from 0.1.19 to 0.1.20.

Release notes

Sourced from oasdiff/oasdiff-action's releases.

v0.1.20

A security release. Every action that uploads a review is affected in its default configuration, so upgrade.

If you pin @v0, as the README recommends, you already have this: the v0 tag now points here, so your next run picks it up with no change on your side. If you pin an exact version, move it to v0.1.20.

Changes

• Base image bumped to oasdiff v1.34.1, which enforces the external-refs policy in the reader that --open installs (#209). Every action that uploads a review runs oasdiff with --open, so without the fix the allow-external-refs input had no effect on that path: a spec arriving in a pull request could read a file from the runner or reach an arbitrary URL, and the content went into the uploaded review. The input itself was already correct and already defaulted to false; only the enforcement one layer down was missing. Affects breaking, changelog and pr-comment. Reported by Zachariah Mithani (AploSec). See GHSA-6h8r-wgc5-q3xv.

Commits

• 9ce3a29 Merge pull request #209 from oasdiff/bump/oasdiff-v1.34.1
• 8689364 bump: oasdiff v1.34.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)