Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.2 to 2.3.1.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@e38b190...0864cf1)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…2702)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2.5.1 to 3.1.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@0efb1d1...6c5ccda)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The `fetchInitialOffset` func in offsetManager was hardcoded to send a
Version 1 OffsetFetchRequest rather than sending the appropriate version
based on the config KafkaVersion. As discussed in #2694 this meant that
LeaderEpoch was always being decoded as the default value '0' (because
it was only returned in Version >= 5 OffsetFetchRequest). However, other
areas of the offsetManager code were sending the newer protocol
versions, so for example the OffsetCommitRequest would include a leader
epoch value of 0 rather than an accurate one.

Correct this bug by sending the correct protocol version in
fetchInitialOffset and also ensure we default to `-1` when we decode an
OffsetFetchResponse of a Version < 5

Fixes #2694

Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>

…2707)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@6c5ccda...9f45b24)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Add GitHub's Contributor Covenant Code of Conduct template

Signed-off-by: Dominic Evans <8060970+dnwe@users.noreply.github.com>

The original validation regex was based on the one that existed in the
Java clients pre-1.0.0 but KIP-190 removed the client-side validation
because instead the brokers were updated to be able to cope with any
clientID and sanitize it before using it in metrics etc.

We can do similar in Sarama and only do client-side validation when the
user has specified a version number older than 1.0.0

Fixes #2697

Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>

Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>