fix(deps): update non-major dependencies by renovate[bot] · Pull Request #37 · thoroc/git-mirror

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

dtolnay/anyhow (anyhow)

`v1.0.104`

Update syn dev-dependency to version 3

`v1.0.103`

Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

`v1.0.102`

Remove backtrace dependency (#438, #439, #440, #441, #442)

aquasecurity/trivy-action (aquasecurity/trivy-action)

`v0.36.0`

What's Changed

chore(ci): update bump-trivy workflow by @DmitriyLewen in #546
ci: use action.yaml as single source of truth for Trivy version by @nikpivkin in #552
ci: replace peter-evans/create-pull-request with gh CLI by @nikpivkin in #550
test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @nikpivkin in #555
ci: add dependabot config by @nikpivkin in #556
chore: add zizmor config by @nikpivkin in #557
chore(deps): bump the actions group with 5 updates by @dependabot[bot] in #558
fix: use portable shebang in entrypoint.sh by @Hayao0819 in #545
Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @patrik-csak in #547
Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 by @Aditya09-cse in #548
chore: use GitHub Actions as git commit author in bump-trivy workflow by @nikpivkin in #561
chore(deps): Update trivy to v0.70.0 by @Argon-DevOps-Mgt in #559
chore: update action version to v0.36.0 in examples by @nikpivkin in #563

New Contributors

@dependabot[bot] made their first contribution in #558
@Hayao0819 made their first contribution in #545
@patrik-csak made their first contribution in #547
@Aditya09-cse made their first contribution in #548
@Argon-DevOps-Mgt made their first contribution in #559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

xd009642/tarpaulin (cargo:cargo-tarpaulin)

`v0.37.5`

Changed

Improved performance of path filtering in llvm-profparsers

`v0.37.4`

Changed

LLVM engine tests now respect --timeout argument
Repeated -Clink-arg values are preserved when updating rustflags and rustdocflags
RUSTDOCFLAGS values are joined to existing values instead of overwriting
Projects with markdown relevant characters in the name now don't cause markdown misrendering
Improve HTML reports to fix some issues (light/dark button not working, long paths overrun layout)

`v0.37.3`

Changed

Use CARGO_ENCODED_RUST(DOC)FLAGS to avoid space splitting issues
Saturating add when adding two line hit counts together.

`v0.37.2`

Fixed

Fix LLVM 23 support for 32 bit profiles

`v0.37.1`

Added

LLVM 23 support to llvm engine

clap-rs/clap (clap)

`v4.6.7`

`v4.6.6`

Features

Add Command::get_overridden_usage

`v4.6.5`

`v4.6.4`

Internal

Update to syn v3

`v4.6.3`

Fixes

(derive) Allow "literal".function() as attribute values

`v4.6.2`

Fixes

(help) Say alias when there is only one

`v4.6.1`

Fixes

(derive) Ensure rebuilds happen when an read env variable is changed

`v4.6.0`

Compatibility

Update MSRV to 1.85

`v4.5.61`

Internal

Update dependencies

`v4.5.60`

Fixes

(help) Quote empty default values, possible values

`v4.5.59`

Fixes

Command::ignore_errors no longer masks help/version on subcommands

`v4.5.58`

console-rs/dialoguer (dialoguer)

`v0.12.0`: 0.12.0

What's Changed

Fix prompt in select.rs example by @jwodder in #289
Document crate feature guarded items on docs.rs by @robjtede in #293
Add conversion between error types by @jacobtread in #300
Accept items by iterator instead of slice by @jacobtread in #299
refactor: replace thiserror with a manual impl by @CosmicHorrorDev in #327
Update console to 0.16 by @musicinmybrain in #329

`v0.11.0`: 0.11.0

What's Changed

Fix compilation of a doc test by @LingMan in #253
Drop .clippy.toml by @LingMan in #252
Polish CI by @LingMan in #254
Add vim mode to FuzzySelect by @damymetzke in #259
Do not error on Key::Unknown in input and confirm by @mitsuhiko in #260
Make inputs fail if not connected to a terminal by @mitsuhiko in #261
fix(select): Switch to correct page before showing select by @francisdb in #267
[#268] Fix Input tail length calculation (wrong cursor positioning) by @finistseb in #269
Record input to history before validation by @Gordon01 in #273
Update MSRV to 1.59 -> 1.63 by @Gordon01 in #274
Provide a basic default implementation of History by @Garbaz in #209
Change chars for MultiSelect items by @Gordon01 in #275
Count characters in password example instead of bytes by @Gordon01 in #276
Remove ColorfulTheme.inline_selections by @Gordon01 in #277
Fix panic in fuzzy-select when using non-ASCII characters by @stormshield-kg in #245
Remove dead code and 'Debug' trait bound on Input's 'interact_text*' methods by @tbergerd in #280
fix #281 : Select : prompt is no longer displayed by @tbergerd in #282

getplumber/plumber (getplumber/plumber)

`v0.5.17`

✨ Features

analyze: accept the repository to scan as a positional target (14f3908)

📚 Documentation

show the positional target in the remote-scan examples (c991a47)

`v0.5.16`

🐛 Bug Fixes

docker: build the image binary for the target platform (8363ff5)

📚 Documentation

contributing: describe the release order and its operation (0e07fa2)
readme: focused CLI README with a real run GIF and a new banner (4a1e7a3), closes getplumber/getplumber.io#438

👷 CI/CD

release: add the scripts that pin the image digest at the tag (9fca2fe)
release: build the image before the tag, pin its digest in it (858a132)
release: pin v0.5.15 refs [skip ci] (20d607d)

`v0.5.15`

🐛 Bug Fixes

docker: build the image binary for the target platform (8363ff5)

📚 Documentation

contributing: describe the release order and its operation (0e07fa2)
readme: focused CLI README with a real run GIF and a new banner (4a1e7a3), closes getplumber/getplumber.io#438

👷 CI/CD

release: add the scripts that pin the image digest at the tag (9fca2fe)
release: build the image before the tag, pin its digest in it (858a132)
release: pin v0.5.15 refs [skip ci] (20d607d)

`v0.5.14`

🐛 Bug Fixes

cmd: banner reads "CI/CD Security Scanner for GitHub & GitLab" (806e12a)
cmd: banner reads just "CI/CD Security Scanner" (ad8cd33)

👷 CI/CD

release: pin v0.5.14 refs [skip ci] (8b4214b)

`v0.5.13`

🐛 Bug Fixes

gitlab: debug log keeps the GraphQL request side only (56c0924)
gitlab: resolve image references only from variables the job can see (e34aa5f)

👷 CI/CD

release: pin v0.5.13 refs [skip ci] (6932291)

`v0.5.12`

✨ Features

ir,github: carry if conditions for jobs, actions and run scripts (4195575), closes #497

🐛 Bug Fixes

policies: resolve the cache-poisoning release path per trigger (37dd0f8), closes #497

📚 Documentation

cache-poisoning: describe the per-trigger resolution and ISSUE-717 everywhere the control is documented (c626275), closes #497

👷 CI/CD

release: pin v0.5.12 refs [skip ci] (6c3956c)

`v0.5.11`

✨ Features

config: trust the whole Microsoft Artifact Registry by default (cb8ce1c)

📚 Documentation

readme: fix the quick start for zero-config runs and homebrew 6 tap trust (bf30577)

👷 CI/CD

release: pin v0.5.11 refs [skip ci] (9984299)

`v0.5.10`

🐛 Bug Fixes

sarif: anchor a repository-level finding to the repository root (af21030), closes #352

👷 CI/CD

release: pin v0.5.10 refs [skip ci] (3b6af14)

`v0.5.9`

🐛 Bug Fixes

control: a failed policy marks only the controls it emits, strict evaluation moves to the tests (7f3dd6c)
control: a policy that fails to evaluate degrades the run instead of passing it (ec9813e), closes #489
policies: a recursive workspace upload packs .git, a Git dot-file does not (e52a267)
policies: an upload of a path under the workspace does not pack .git (07b0c26)
policies: artipacked handles several upload-artifact steps in one job (d4e9402), closes #489

👷 CI/CD

release: pin v0.5.9 refs [skip ci] (c93bf1c)

`v0.5.8`

🐛 Bug Fixes

control: derive the disabled-control set from ControlsConfig (aa486ae)

♻️ Refactoring

one implementation for each duplicated helper (7295e37)

🔧 Chores

consistent naming, comment forms and signatures across packages (b8f9ab6)

📚 Documentation

package comments for every package, deprecated identity helper removed (e541e17)

✅ Tests

gitlab: pin NormalizeYAMLValue on nested, non-string-keyed and scalar input (04b4e21)

👷 CI/CD

release: pin v0.5.8 refs [skip ci] (22f7fcd)

`v0.5.7`

🐛 Bug Fixes

cmd: the bill mirrors the platform's byte and edge bounds, a bill the platform would refuse is omitted whole (d94a6c0)
gitlab,pbom: a component include carries its project, the bill of materials can key the component (34480c8)

✅ Tests

cmd: the edge bound is pinned through the services and runner tags terms (review) (7ba89d7)

👷 CI/CD

release: pin v0.5.7 refs [skip ci] (0dd46fb)

`v0.5.6`

🐛 Bug Fixes

cmd: the bill's bounds are measured on the wire section, an image naming more than 500 jobs omits the bill (91a74d9)
cmd: the platform push carries the pipeline bill of materials (bom, schema 1, bounded) (c0f1a21)
ir,gitlab,pbom: a job carries its runner tags, the bill of materials names each job's services and tags (1d3c9a6)

👷 CI/CD

release: pin v0.5.6 refs [skip ci] (ab18ada)

`v0.5.5`

🐛 Bug Fixes

catalog: the control catalog names the gitlab tier a control or a field requires (ask 56) (8130a2c)
configuration,policies: the default branch is a forbidden include version by default, mr fields lose descriptions (50a60b0)
control,configuration: CTRL-102 is named container images must not use forbidden reference, the name copies agree (7ebbb6a)
policies: every gitlab finding message reads as one clear sentence with its technical tokens quoted (c298ed0)

✅ Tests

policies: every rewritten label and message branch is rendered by the corpus, ISSUE-506 labels are complete (18d0215)
policies: the ISSUE-502 and ISSUE-601 message branches are asserted, the lint rejects empty backquotes (9abef9a), closes #484
policies: the ISSUE-505 reasons are asserted and every string array in finding data passes the lint (c684a76)
policies: the squash clause of ISSUE-506 and every ISSUE-413 detail branch render through the lint (3ec811e)

👷 CI/CD

release: pin v0.5.5 refs [skip ci] (d874910)

`v0.5.4`

🐛 Bug Fixes

github: a branch rename redirect is not a branch for ISSUE-402 (ae2d2c2), closes #482 #482
gitlab: spec:include input files contribute no jobs to attribution (57d8c82), closes #471 #471

👷 CI/CD

release: pin v0.5.4 refs [skip ci] (5dbcedb)

`v0.5.3`

✨ Features

catalog: export toggle semantics for behavior-switch booleans (46c5014)

👷 CI/CD

release: pin v0.5.3 refs [skip ci] (a36dcb4)

`v0.5.2`

🐛 Bug Fixes

gitlab: a required template matches its identity from the ref, not only its file path (056e7c8)
gitlab: a versioned template include keeps its template identity when the tag listing fails (724aa10)
platform: a linked run never calls GitLab for an include the platform served without its observation (d990b31)
platform: a version fact the platform did not serve reads as platform_observation_missing, not as a failed probe (52e1c47)

👷 CI/CD

release: pin v0.5.2 refs [skip ci] (cd7ef86)

`v0.5.1`

✨ Features

identity: recipe version 6, one identity per rule for ISSUE-405, ISSUE-408 and ISSUE-417 (b4f43ed)
policies: one finding per rule for missing required templates, components and actions (row 107) (50f6cf7)

👷 CI/CD

release: pin v0.5.1 refs [skip ci] (0648860)

`v0.5.0`

🐛 Bug Fixes

component: run the plumber job on branch pipelines with an open MR and on plumber/ branches (045fe6f), closes #476

📚 Documentation

component: list when the plumber job runs and the workflow rule that avoids a duplicate pipeline (c083e0a), closes getplumber/plumber#476

👷 CI/CD

release: pin v0.5.0 refs [skip ci] (1472696)

`v0.4.63`

⚠ BREAKING CHANGES

identity: every ISSUE-406 and ISSUE-409 finding re-keys; a dismissal made under recipe version 4 no longer suppresses them and the platform re-detects the issue once.

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01FUFtr3m8zC2mVNKVTQvaNz

✨ Features

identity: recipe version 5, the override fingerprint keys ISSUE-406 and ISSUE-409 (38c87b0)
ir: fingerprint an include's override content from the overridden keys and their values (a8378a5)
policies: overridden findings carry the override fingerprint and the overridden jobs (e133aba)

🐛 Bug Fixes

ir: the override fingerprint hashes the whole local job block, nested keys included (12fac4c)

👷 CI/CD

release: pin v0.4.63 refs [skip ci] (9c6f60d)

`v0.4.62`

✨ Features

cmd: push a linked run that evaluated nothing, with the marker the platform records (row 63) (c713d04)
control: drive platform-mode collection from the union of the resolved policies (row 62) (f318bcb)

🐛 Bug Fixes

cmd: ignore --controls and --skip-controls on a linked run (row 64) (f93ed94)
cmd: terminal, exit code and docs follow the policy verdicts on a linked run (row 62) (9b5d4ff)

♻️ Refactoring

gitlab: export the multi-document CI parser as ParseGitlabCIConf (row 54) (0795790)

👷 CI/CD

release: pin v0.4.62 refs [skip ci] (1840df4)

`v0.4.61`

🐛 Bug Fixes

gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
platform: a served empty include list is complete attribution, not unknown (754ab69)
platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

platform: pin the no-attribution branch of the includes served line (9b18a79)
platform: pin the wire-level decode of resolve response includes (4e2837d)

👷 CI/CD

release: pin v0.4.61 refs [skip ci] (cc366ec)

`v0.4.60`

✨ Features

configuration: export nullable on schema fields so an editor knows when unset is meaningful (6ce3630)
platform: require --platform-allow-http before sending credentials to a plain-http platform (fe0537c)
scoring: withhold the score when no control was evaluated (230a389)

🐛 Bug Fixes

cmd: keep the degraded-collection message ahead of the withheld score (d594e7f)
scoring: count a finding once per identity so the job and the platform score the same input (ed43bb5)
utils: strip userinfo from the parsed git remote so a token clone still matches the analyzed project (b571f61)

📚 Documentation

plans: cli batch 2, platform decision rows 41, 45, 46, 51, 52 (4148d57)

✅ Tests

cmd: assert the withheld-score gate line when controls exist but none was evaluated (7ecdabc)
cmd: pin the plain-http refusal on the GitHub analysis path (894a527)

👷 CI/CD

release: pin v0.4.60 refs [skip ci] (cb34e01)

`v0.4.59`

✨ Features

platform: decode policy min_points and the push response's global score into a verdict (83dbfba)
platform: evaluate resolved policies as first-class runs with no local fallback (1fedc61)
platform: in platform mode the resolved policies drive the log, the push and the exit code (8f4b6ba)
platform: local gates, thresholds and the degraded exit are inert in platform mode (551eac6)
platform: per-policy artifacts, badge and MR comment from the platform verdict (5ef59c2), closes #467
platform: per-policy log sections and the platform verdict block (13d0da9)

🐛 Bug Fixes

platform: a --no-controls run is not platform mode in the summary (65ae90c)
platform: carry each run's not-evaluable marks in its policy report entry (d16571b)
platform: decode the gate strictly, only the global score tolerantly (ef0733a)
platform: honest verdict line, collection diagnostics and header in platform mode (db8aedf)
platform: inventory runs keep their guards in platform mode, pin the run-level dismissal mark (ee6de90)
platform: platform-mode artifacts carry only the policies' verdicts (b8c3411)
platform: tolerant gate decode and validated global letter (9c292fe)
platform: track the two image controls independently in pbom verdicts (2928548)

📚 Documentation

platform: platform mode evaluates only the platform's policies and takes its verdict (8ff0c69)
platform: replace em dashes and restore template backticks (f73aa78)

✅ Tests

platform: cover outputControlEntries's multi-policy accumulation (7e7fe68)
platform: cover the post-action and pbom summaries through the cmd path (7e334ba)
platform: cover the report's un-applied policy entry and min_points (93b6185)
platform: cover the union's not-evaluable swap and the degraded sections (e10cc50), closes #220
platform: pin the notEvaluable key removal in platform-mode json reports (6cc5dd0)

👷 CI/CD

release: pin v0.4.59 refs [skip ci] (8da00d4)

`v0.4.58`

✨ Features

platform: propagate platform dismissals: match, mark, exclude from the score, push the marker (ffe94ce), closes #447
scoring: report an enabled but unconfigured control as not_evaluable (config_required) (78ca84a), closes #459

🐛 Bug Fixes

platform: declare the checkout safe for git and log why git failed (31fa6e7), closes #464
platform: review follow-ups: pin the run-level dismissal path, harden the git helper, docs (d6e1b03)

📚 Documentation

platform: design and plan for the safe checkout, unconfigured controls and dismissal propagation (4ad52a0)

👷 CI/CD

release: pin v0.4.58 refs [skip ci] (65610c8)

`v0.4.57`

✨ Features

platform: export the score band and push final_points (95216ef)

👷 CI/CD

release: pin v0.4.57 refs [skip ci] (d7bb560)

`v0.4.56`

✨ Features

cidigest: add the wire-stable ci config digest_v1 replica (ADR-0034 rule 1) (3cb009c)
platform: decode project details, security policy, raw config and merge status from the snapshot (f0abae3)
platform: evaluate merge settings and security policy from the snapshot lanes (1892301)
platform: use the served merge status, ci errors and raw config (607912c)

🐛 Bug Fixes

platform: gate the served raw config on the anchor, validate the merge status (628c343)
platform: serve the raw config only at the snapshot's commit; name absent lanes (7faf706)

📚 Documentation

platform: design spec for platform-mode collection without a GitLab token (640128f)
platform: implementation plan for token-free platform-mode collection (7c9e6d1)
platform: rescope the platform-mode work to the snapshot lanes the cli does not consume yet (68c25e5)

👷 CI/CD

release: pin v0.4.56 refs [skip ci] (2c9b116)

`v0.4.55`

✨ Features

catalog: authored requiresConfig flag for controls inert without configuration (#458) (747baab), closes getplumber/plumber#459
catalog: export the control/issue catalog as the single source of truth (#458) (15ed919), closes #448

🐛 Bug Fixes

catalog: drop the false debug-trace default; the engine has no built-in list (6a7c2dd)
catalog: rendered-string cleanup, contract guard tests and CI deadcode exemption (#458) (8317e03)

📚 Documentation

catalog: design spec and implementation plan for the catalog export (#458) (6ebc83c)

👷 CI/CD

release: pin v0.4.55 refs [skip ci] (bad1d73)

`v0.4.54`

🐛 Bug Fixes

address review comment on #442 (0d67cd6)
BUG: ISSUE-705 cannot see a ref-scoped type=gha buildx cache (scope= parameter ignored) (#433) (25facb0)

👷 CI/CD

release: pin v0.4.54 refs [skip ci] (a5d3fd5)

`v0.4.53`

🐛 Bug Fixes

ci: build release binaries with Go 1.26.6 (a5fc07c), closes #446

👷 CI/CD

release: pin v0.4.53 refs [skip ci] (b03e5d3)

`v0.4.52`

🐛 Bug Fixes

image: move to Alpine 3.23 and bump x/crypto to v0.56.0 to clear image CVEs (77425b9)

?

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-08-17T02:50:03Z

🛡️ Plumber — CI/CD Security Compliance

✅ No Critical-severity findings

🟠 High (15)

Code

Location

Source

ISSUE-701

ci/build

Line 48 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-701

ci/coverage

Line 99 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-701

ci/coverage

Line 108 in a9e931b

uses: codecov/codecov-action@v4

ISSUE-701

ci/security-audit

Line 81 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-701

release-please/build_and_upload

Line 73 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-701

release-please/release

Line 27 in a9e931b

uses: googleapis/release-please-action@v4

ISSUE-713

ci/build

Line 48 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-713

ci/coverage

Line 99 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-713

ci/security-audit

git-mirror/.github/workflows/kingfisher.yml

Line 81 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-713

kingfisher/kingfisher

Line 44 in a9e931b

- uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0

ISSUE-713

release-please/build_and_upload

Line 73 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-714

ci/build

Line 48 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-714

ci/coverage

Line 99 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-714

ci/security-audit

Line 81 in a9e931b

uses: dtolnay/rust-toolchain@stable

ISSUE-714

release-please/build_and_upload

Line 73 in a9e931b

uses: dtolnay/rust-toolchain@stable

🔵 Low (9)

Code

Location

Source

ISSUE-307

ci/build

Line 43 in a9e931b

- uses: actions/checkout@v4

ISSUE-307

ci/coverage

Line 94 in a9e931b

- uses: actions/checkout@v4

ISSUE-307

ci/dependency-scan

Line 118 in a9e931b

- uses: actions/checkout@v4

ISSUE-307

ci/security-audit

git-mirror/.github/workflows/kingfisher.yml

Line 78 in a9e931b

- uses: actions/checkout@v4

ISSUE-307

kingfisher/kingfisher

Line 40 in a9e931b

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

ISSUE-307

plumber/plumber

git-mirror/.github/workflows/plumber.yml

Line 50 in a9e931b

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

ISSUE-307

release-please/build_and_upload

Line 63 in a9e931b

uses: actions/checkout@v4

ISSUE-307

release-please/create_release

Line 164 in a9e931b

uses: actions/checkout@v4

ISSUE-307

release-please/release