Sourced from ossf/scorecard-action's releases.

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2

• 05b42c6 :seedling: bump docker to ghcr v2.4.2 (#1548)
• b225da6 Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (#1550)
• 9399f6f :seedling: Bump the docker-images group across 1 directory with 2 updates (#1...
• e1daa8c :seedling: Bump the github-actions group across 1 directory with 5 updates (#...
• 9fe6511 :seedling: Bump golang.org/x/net from 0.39.0 to 0.40.0 (#1542)
• 25b9cd9 :seedling: Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (#1547)
• 18cc9b8 :seedling: Bump golang.org/x/net from 0.38.0 to 0.39.0 (#1536)
• db78142 :seedling: Bump the github-actions group with 2 updates (#1538)
• de386ed :seedling: Bump golang from 1.24.1 to 1.24.2 in the docker-images group (#1534)
• 5b7cedb :seedling: Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#1537)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)