Bump zaproxy/action-api-scan from 0.9.0 to 0.10.0

[dependabot]

Bumps zaproxy/action-api-scan from 0.9.0 to 0.10.0.

Release notes

Sourced from zaproxy/action-api-scan's releases.

Version 0.10.0

Changed

• Update dependencies.
• Run with node24.

Changelog

Sourced from zaproxy/action-api-scan's changelog.

Changelog

All notable changes to this GitHub action will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased]

[0.10.0] - 2025-10-24

Changed

• Update dependencies.
• Run with node24.

[0.9.0] - 2024-11-20

Changed

• Update dependencies to stop using deprecated upload-artifact version.

[0.8.0] - 2024-09-25

Changed

• Update dependencies, which adds rate-limiting when accessing the GitHub API.

Fixed

• Allow to write any file from the Docker container. #22

[0.7.0] - 2024-04-02

Changed

• Update dependencies.

[0.6.0] - 2024-01-25

Changed

• Run with node20. #29

[0.5.0] - 2023-08-24

Added

• An input (artifact_name) used to name the artifact that contains the ZAP reports.

[0.4.0] - 2023-08-02

Changed

• The default Docker image was changed to ghcr.io/zaproxy/zaproxy:stable.

[0.3.1] - 2023-07-05

Fixed

• Check issues with authenticated user. #19

[0.3.0] - 2023-06-29

Changed

• To use Node 16
• Updated dependencies

... (truncated)

Commits

• 5158fe4 Merge pull request #52 from thc202/release-v0.10.0
• 4315c7d Release v0.10.0
• ca6adda Merge pull request #51 from zaproxy/dependabot/npm_and_yarn/brace-expansion-1...
• 4b59770 Bump brace-expansion from 1.1.11 to 1.1.12
• 9defb55 Merge pull request #50 from thc202/nodejs24
• 1d86b69 Bump Node.js and update dependencies
• 70b09b8 Merge pull request #49 from zaproxy/dependabot/npm_and_yarn/octokit/endpoint-...
• 928a1c3 Update dist file
• e3a8202 Merge pull request #47 from zaproxy/dependabot/npm_and_yarn/babel/helpers-7.27.6
• 25b0677 Update dist file and changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/zaproxy/action-api-scan	5158fe4d9d8fcc75ea204db81317cce7f9e5453d	🟢 4.6	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected Vulnerabilities 🟢 6 4 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/main.yml