fix(deps): update non-major dependencies by renovate[bot] · Pull Request #37 · thoroc/git-mirror

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

dtolnay/anyhow (anyhow)

`v1.0.104`

Update syn dev-dependency to version 3

`v1.0.103`

Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

`v1.0.102`

Remove backtrace dependency (#438, #439, #440, #441, #442)

aquasecurity/trivy-action

`v0.36.0`

What's Changed

chore(ci): update bump-trivy workflow by @DmitriyLewen in #546
ci: use action.yaml as single source of truth for Trivy version by @nikpivkin in #552
ci: replace peter-evans/create-pull-request with gh CLI by @nikpivkin in #550
test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @nikpivkin in #555
ci: add dependabot config by @nikpivkin in #556
chore: add zizmor config by @nikpivkin in #557
chore(deps): bump the actions group with 5 updates by @dependabot[bot] in #558
fix: use portable shebang in entrypoint.sh by @Hayao0819 in #545
Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @patrik-csak in #547
Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 by @Aditya09-cse in #548
chore: use GitHub Actions as git commit author in bump-trivy workflow by @nikpivkin in #561
chore(deps): Update trivy to v0.70.0 by @Argon-DevOps-Mgt in #559
chore: update action version to v0.36.0 in examples by @nikpivkin in #563

New Contributors

@dependabot[bot] made their first contribution in #558
@Hayao0819 made their first contribution in #545
@patrik-csak made their first contribution in #547
@Aditya09-cse made their first contribution in #548
@Argon-DevOps-Mgt made their first contribution in #559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

xd009642/tarpaulin (cargo:cargo-tarpaulin)

`v0.37.5`

Changed

Improved performance of path filtering in llvm-profparsers

`v0.37.4`

Changed

LLVM engine tests now respect --timeout argument
Repeated -Clink-arg values are preserved when updating rustflags and rustdocflags
RUSTDOCFLAGS values are joined to existing values instead of overwriting
Projects with markdown relevant characters in the name now don't cause markdown misrendering
Improve HTML reports to fix some issues (light/dark button not working, long paths overrun layout)

`v0.37.3`

Changed

Use CARGO_ENCODED_RUST(DOC)FLAGS to avoid space splitting issues
Saturating add when adding two line hit counts together.

`v0.37.2`

Fixed

Fix LLVM 23 support for 32 bit profiles

`v0.37.1`

Added

LLVM 23 support to llvm engine

clap-rs/clap (clap)

`v4.6.7`

Features

(derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

`v4.6.6`

Features

Add Command::get_overridden_usage

`v4.6.5`

Fixes

(help) Correctly mark which value_names are optional with num_args

`v4.6.4`

Internal

Update to syn v3

`v4.6.3`

Fixes

(derive) Allow "literal".function() as attribute values

`v4.6.2`

Fixes

(help) Say alias when there is only one

`v4.6.1`

Fixes

(derive) Ensure rebuilds happen when an read env variable is changed

`v4.6.0`

Compatibility

Update MSRV to 1.85

`v4.5.61`

Internal

Update dependencies

`v4.5.60`

Fixes

(help) Quote empty default values, possible values

`v4.5.59`

Fixes

Command::ignore_errors no longer masks help/version on subcommands

`v4.5.58`

console-rs/dialoguer (dialoguer)

`v0.12.0`: 0.12.0

What's Changed

Fix prompt in select.rs example by @jwodder in #289
Document crate feature guarded items on docs.rs by @robjtede in #293
Add conversion between error types by @jacobtread in #300
Accept items by iterator instead of slice by @jacobtread in #299
refactor: replace thiserror with a manual impl by @CosmicHorrorDev in #327
Update console to 0.16 by @musicinmybrain in #329

`v0.11.0`: 0.11.0

What's Changed

Fix compilation of a doc test by @LingMan in #253
Drop .clippy.toml by @LingMan in #252
Polish CI by @LingMan in #254
Add vim mode to FuzzySelect by @damymetzke in #259
Do not error on Key::Unknown in input and confirm by @mitsuhiko in #260
Make inputs fail if not connected to a terminal by @mitsuhiko in #261
fix(select): Switch to correct page before showing select by @francisdb in #267
[#268] Fix Input tail length calculation (wrong cursor positioning) by @finistseb in #269
Record input to history before validation by @Gordon01 in #273
Update MSRV to 1.59 -> 1.63 by @Gordon01 in #274
Provide a basic default implementation of History by @Garbaz in #209
Change chars for MultiSelect items by @Gordon01 in #275
Count characters in password example instead of bytes by @Gordon01 in #276
Remove ColorfulTheme.inline_selections by @Gordon01 in #277
Fix panic in fuzzy-select when using non-ASCII characters by @stormshield-kg in #245
Remove dead code and 'Debug' trait bound on Input's 'interact_text*' methods by @tbergerd in #280
fix #281 : Select : prompt is no longer displayed by @tbergerd in #282

getplumber/plumber

`v0.7.6`

🐛 Bug Fixes

github: read a local action's entrypoint within the repository (018074a)
github: resolve only well-formed action references (b06e171)
gitlab: bound variable and local-include expansion (13a6f97)

`v0.7.5`

✨ Features

capability: the declarations from the context or .plumber.yaml, and the defaults command (6686e3f)
capability: the first recognizer and the five evidence rules (31b1782)
capability: user-declared capabilities, the built-in list and the glob matcher (024cce3)
ir: a job carries the keys of its artifacts.reports and the include that defined it (8482d15)
pbom: the bill carries the recognized capabilities from the push and the --pbom artifact (5541574)

`v0.7.4`

🔧 Chores

deps: bump the go-dependencies group across 1 directory with 6 updates (d8b6b08)

`v0.7.3`

🔧 Chores

ci: bump the github-actions group across 1 directory with 14 updates (c5b9cf0)

`v0.7.2`

✨ Features

github: resolve composite actions and cross-repository reusable workflows into the pipeline with their provenance (1ba603c)

🐛 Bug Fixes

control,identity: nested findings carry their chain, remediation and identity, the bill names nested includes (35459d5), closes #533

✅ Tests

github,cmd: goldens from the nested-actions reproduction, docs and the e2e recipe (620b4de), closes d/action.yml#L8

`v0.7.1`

✨ Features

github: who can trigger a job, environments, inert jobs and the real token default (717c944)
report: every claim of a path carries its state, the Radar corpus as the regression gate (b26a7ae)
score: claim states and a three-valued evaluator for job conditions (d3cb330)
score: the tier follows what is proven (968840b)

`v0.7.0`

⚠ BREAKING CHANGES

controls: releaseWorkflowsMustNotRestoreUntrustedCache is renamed
untrustedTriggersMustNotWriteCache, and publishActions, cacheActions,
publishScriptPatterns, publishScriptExcludePatterns and allowedJobs are
removed. The old key is ignored with a warning; plumber config migrate
renames it. exemptWorkflows and exemptJobs accept the risk of a workflow
or a job, listed in the output. ISSUE-705 findings re-key (RecipeVersion 7).

🐛 Bug Fixes

controls: flag cache write granted to untrusted triggers (e8f9e5a), closes #533

✅ Tests

controls: pin every context a cache-mode expression can read (8fbab2b)

`v0.6.5`

✨ Features

brand: teal banner and terminal accent for the new identity (4330818), closes #09C3C3

📚 Documentation

readme: teal wordmark in the plumber analyze recording (5917a18)

`v0.6.4`

✨ Features

controls: exempt listed images on a forbidden tag (b95c432)

📚 Documentation

add a pull request template (fff78d0)

`v0.6.3`

✨ Features

cli: the update notice names the upgrade command of the install channel (7284a53)

✅ Tests

cli: pin the Homebrew prefixes alone and a go install build's version (a193a10)

👷 CI/CD

prove that brew, mise and go install serve the latest release (e25d155)
the mise channel check resolves without the 24-hour release age (af8ce1e)

`v0.6.2`

✨ Features

report: platform mode closes a withheld policy on the Score block too (00ae5de)
report: the withheld score closes on the Score block too (0a909cf)

🐛 Bug Fixes

report: findings, never issues, in every user-facing text (b809185)

📚 Documentation

readme: add Duplicati to the adopters row (7d3a0e0), closes duplicati/duplicati#7259

✅ Tests

report: a degraded run writes its artifacts above the withheld block (a0d6790)

`v0.6.1`

✨ Features

conf: trust Plumber's own GitLab component by default (b400431)
controls: components and functions must come from authorized sources (b2bb03a)
gitlab: collect run: step functions and the registry host in the IR (59c9ddd)
score: component and function sources in the contextual score (44c5d28)

🐛 Bug Fixes

build: move to the Go 1.26.9 toolchain (6449f05)

`v0.6.0`

⚠ BREAKING CHANGES

analyze: score letters, --min-score and --min-points gates and badges now read the contextual score. Run with --score-profile v3 or set PLUMBER_ANALYZE_SCORE_PROFILE=v3 to keep the previous formula.

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Ft8dmcMLK7V9XZh7JX4vzs

✨ Features

analyze: the contextual score is the default, on every output, with the labelled corpus and the migration report (41eff60)
situation: job facts for attack paths, entry subjects, push trigger filters and cache inheritance (89f30e4)

`v0.5.24`

✨ Features

config: exempt dependabot actions from the pin-by-SHA default (834d9c4)

📚 Documentation

readme: add Outscale and Telstra to the adopters row (428a960)

✅ Tests

control: pin the shipped pin-by-SHA trust boundary to GitHub-owned orgs (ec5c1ef), closes #531

`v0.5.23`

✨ Features

config: trust jfrog-fastci actions in the default allowlist (4b55d04)

`v0.5.22`

✨ Features

config: trust CodSpeedHQ actions in the default allowlist (27f0d74)

`v0.5.21`

✨ Features

#362: run the job in a dedicated environment (69fc105), closes #362

📚 Documentation

#362: scope GITLAB_TOKEN to the plumber environment (85caadb), closes #362
readme: add Stellarium to the adopters row (338ab07)

`v0.5.20`

✨ Features

control: a role per issue code and one severity source (d1a6b4a)

`v0.5.19`

✨ Features

control: evaluate the situation facts and attach them to the analysis (399b67d)
gitlab: jobs carry only and except (ce1bdf5)
situation: per-job situation facts and their engine entry point (3f286fa)

`v0.5.18`

✨ Features

github: collect the repository visibility into the pipeline (0f8e228)
github: jobs carry runs-on, needs, caches and artifacts (7d98eff)
gitlab: copy the project visibility onto the pipeline (6f3c660)
gitlab: jobs carry needs, caches, artifacts and environment (b40dcc5)
ir: visibility, runs-on, needs, caches and artifacts on the pipeline model (9bd2d5a)

📚 Documentation

readme: use the official Resty logo in the adopters row (40125a7)

`v0.5.17`

✨ Features

analyze: accept the repository to scan as a positional target (14f3908)

📚 Documentation

show the positional target in the remote-scan examples (c991a47)

`v0.5.16`

🐛 Bug Fixes

docker: build the image binary for the target platform (8363ff5)

📚 Documentation

contributing: describe the release order and its operation (0e07fa2)
readme: focused CLI README with a real run GIF and a new banner (4a1e7a3), closes getplumber/getplumber.io#438

👷 CI/CD

release: add the scripts that pin the image digest at the tag (9fca2fe)
release: build the image before the tag, pin its digest in it (858a132)
release: pin v0.5.15 refs [skip ci] (20d607d)

`v0.5.15`

🐛 Bug Fixes

docker: build the image binary for the target platform (8363ff5)

📚 Documentation

contributing: describe the release order and its operation (0e07fa2)
readme: focused CLI README with a real run GIF and a new banner (4a1e7a3), closes getplumber/getplumber.io#438

👷 CI/CD

release: add the scripts that pin the image digest at the tag (9fca2fe)
release: build the image before the tag, pin its digest in it (858a132)
release: pin v0.5.15 refs [skip ci] (20d607d)

`v0.5.14`

🐛 Bug Fixes

cmd: banner reads "CI/CD Security Scanner for GitHub & GitLab" (806e12a)
cmd: banner reads just "CI/CD Security Scanner" (ad8cd33)

👷 CI/CD

release: pin v0.5.14 refs [skip ci] (8b4214b)

`v0.5.13`

🐛 Bug Fixes

gitlab: debug log keeps the GraphQL request side only (56c0924)
gitlab: resolve image references only from variables the job can see (e34aa5f)

👷 CI/CD

release: pin v0.5.13 refs [skip ci] (6932291)

`v0.5.12`

✨ Features

ir,github: carry if conditions for jobs, actions and run scripts (4195575), closes #497

🐛 Bug Fixes

policies: resolve the cache-poisoning release path per trigger (37dd0f8), closes #497

📚 Documentation

cache-poisoning: describe the per-trigger resolution and ISSUE-717 everywhere the control is documented (c626275), closes #497

👷 CI/CD

release: pin v0.5.12 refs [skip ci] (6c3956c)

`v0.5.11`

✨ Features

config: trust the whole Microsoft Artifact Registry by default (cb8ce1c)

📚 Documentation

readme: fix the quick start for zero-config runs and homebrew 6 tap trust (bf30577)

👷 CI/CD

release: pin v0.5.11 refs [skip ci] (9984299)

`v0.5.10`

🐛 Bug Fixes

sarif: anchor a repository-level finding to the repository root (af21030), closes #352

👷 CI/CD

release: pin v0.5.10 refs [skip ci] (3b6af14)

`v0.5.9`

🐛 Bug Fixes

control: a failed policy marks only the controls it emits, strict evaluation moves to the tests (7f3dd6c)
control: a policy that fails to evaluate degrades the run instead of passing it (ec9813e), closes #489
policies: a recursive workspace upload packs .git, a Git dot-file does not (e52a267)
policies: an upload of a path under the workspace does not pack .git (07b0c26)
policies: artipacked handles several upload-artifact steps in one job (d4e9402), closes #489

👷 CI/CD

release: pin v0.5.9 refs [skip ci] (c93bf1c)

`v0.5.8`

🐛 Bug Fixes

control: derive the disabled-control set from ControlsConfig (aa486ae)

♻️ Refactoring

one implementation for each duplicated helper (7295e37)

🔧 Chores

consistent naming, comment forms and signatures across packages (b8f9ab6)

📚 Documentation

package comments for every package, deprecated identity helper removed (e541e17)

✅ Tests

gitlab: pin NormalizeYAMLValue on nested, non-string-keyed and scalar input (04b4e21)

👷 CI/CD

release: pin v0.5.8 refs [skip ci] (22f7fcd)

`v0.5.7`

🐛 Bug Fixes

cmd: the bill mirrors the platform's byte and edge bounds, a bill the platform would refuse is omitted whole (d94a6c0)
gitlab,pbom: a component include carries its project, the bill of materials can key the component (34480c8)

✅ Tests

cmd: the edge bound is pinned through the services and runner tags terms (review) (7ba89d7)

👷 CI/CD

release: pin v0.5.7 refs [skip ci] (0dd46fb)

`v0.5.6`

🐛 Bug Fixes

cmd: the bill's bounds are measured on the wire section, an image naming more than 500 jobs omits the bill (91a74d9)
cmd: the platform push carries the pipeline bill of materials (bom, schema 1, bounded) (c0f1a21)
ir,gitlab,pbom: a job carries its runner tags, the bill of materials names each job's services and tags (1d3c9a6)

👷 CI/CD

release: pin v0.5.6 refs [skip ci] (ab18ada)

`v0.5.5`

🐛 Bug Fixes

catalog: the control catalog names the gitlab tier a control or a field requires (ask 56) (8130a2c)
configuration,policies: the default branch is a forbidden include version by default, mr fields lose descriptions (50a60b0)
control,configuration: CTRL-102 is named container images must not use forbidden reference, the name copies agree (7ebbb6a)
policies: every gitlab finding message reads as one clear sentence with its technical tokens quoted (c298ed0)

✅ Tests

policies: every rewritten label and message branch is rendered by the corpus, ISSUE-506 labels are complete (18d0215)
policies: the ISSUE-502 and ISSUE-601 message branches are asserted, the lint rejects empty backquotes (9abef9a), closes #484
policies: the ISSUE-505 reasons are asserted and every string array in finding data passes the lint (c684a76)
policies: the squash clause of ISSUE-506 and every ISSUE-413 detail branch render through the lint (3ec811e)

👷 CI/CD

release: pin v0.5.5 refs [skip ci] (d874910)

`v0.5.4`

🐛 Bug Fixes

github: a branch rename redirect is not a branch for ISSUE-402 (ae2d2c2), closes #482 #482
gitlab: spec:include input files contribute no jobs to attribution (57d8c82), closes #471 #471

👷 CI/CD

release: pin v0.5.4 refs [skip ci] (5dbcedb)

`v0.5.3`

✨ Features

catalog: export toggle semantics for behavior-switch booleans (46c5014)

👷 CI/CD

release: pin v0.5.3 refs [skip ci] (a36dcb4)

`v0.5.2`

🐛 Bug Fixes

gitlab: a required template matches its identity from the ref, not only its file path (056e7c8)
gitlab: a versioned template include keeps its template identity when the tag listing fails (724aa10)
platform: a linked run never calls GitLab for an include the platform served without its observation (d990b31)
platform: a version fact the platform did not serve reads as platform_observation_missing, not as a failed probe (52e1c47)

👷 CI/CD

release: pin v0.5.2 refs [skip ci] (cd7ef86)

`v0.5.1`

🐛 Bug Fixes

docker: build the image binary for the target platform (8363ff5)

📚 Documentation

contributing: describe the release order and its operation (0e07fa2)
readme: focused CLI README with a real run GIF and a new banner (4a1e7a3), closes getplumber/getplumber.io#438

👷 CI/CD

release: add the scripts that pin the image digest at the tag (9fca2fe)
release: build the image before the tag, pin its digest in it (858a132)
release: pin v0.5.15 refs [skip ci] (20d607d)

`v0.5.0`

🐛 Bug Fixes

component: run the plumber job on branch pipelines with an open MR and on plumber/ branches (045fe6f), closes #476

📚 Documentation

component: list when the plumber job runs and the workflow rule that avoids a duplicate pipeline (c083e0a), closes getplumber/plumber#476

👷 CI/CD

release: pin v0.5.0 refs [skip ci] (1472696)

`v0.4.63`

⚠ BREAKING CHANGES

identity: every ISSUE-406 and ISSUE-409 finding re-keys; a dismissal made under recipe version 4 no longer suppresses them and the platform re-detects the issue once.

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01FUFtr3m8zC2mVNKVTQvaNz

✨ Features

identity: recipe version 5, the override fingerprint keys ISSUE-406 and ISSUE-409 (38c87b0)
ir: fingerprint an include's override content from the overridden keys and their values (a8378a5)
policies: overridden findings carry the override fingerprint and the overridden jobs (e133aba)

🐛 Bug Fixes

ir: the override fingerprint hashes the whole local job block, nested keys included (12fac4c)

👷 CI/CD

release: pin v0.4.63 refs [skip ci] (9c6f60d)

`v0.4.62`

✨ Features

cmd: push a linked run that evaluated nothing, with the marker the platform records (row 63) (c713d04)
control: drive platform-mode collection from the union of the resolved policies (row 62) (f318bcb)

🐛 Bug Fixes

cmd: ignore --controls and --skip-controls on a linked run (row 64) (f93ed94)
cmd: terminal, exit code and docs follow the policy verdicts on a linked run (row 62) (9b5d4ff)

♻️ Refactoring

gitlab: export the multi-document CI parser as ParseGitlabCIConf (row 54) (0795790)

👷 CI/CD

release: pin v0.4.62 refs [skip ci] (1840df4)

`v0.4.61`

🐛 Bug Fixes

gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
platform: a served empty include list is complete attribution, not unknown (754ab69)
platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

platform: pin the no-attribution branch of the includes served line ([9b18a79](https://redirect.github.com/getplumber/plumber/commit/9b18a

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-08-17T02:50:03Z

🛡️ Plumber — CI/CD Security Compliance

✅ No Critical-severity findings

🟠 High (4)

Code

Location

Source

ISSUE-714

ci/build

Line 48 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

ISSUE-714

ci/coverage

Line 99 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

ISSUE-714

ci/security-audit

Line 81 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

ISSUE-714

release-please/build_and_upload

Line 73 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

🟡 Medium (5)

Code

Location

Source

ISSUE-713

ci/build

Line 48 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

ISSUE-713

ci/coverage

Line 99 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

ISSUE-713

ci/security-audit

git-mirror/.github/workflows/kingfisher.yml

Line 81 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

ISSUE-713

kingfisher/kingfisher

Line 44 in 48ef2d3

- uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0

ISSUE-713

release-please/build_and_upload

Line 73 in 48ef2d3

uses: dtolnay/rust-toolchain@stable

🔵 Low (10)

Code

Location

Source

ISSUE-307

ci/build

Line 43 in 48ef2d3

- uses: actions/checkout@v4

ISSUE-307

ci/coverage

Line 94 in 48ef2d3

- uses: actions/checkout@v4

ISSUE-307

ci/dependency-scan

https://github.com/aquasecurity/setup-trivy/blob/3fb12ec12f41e471780db15c232d5dd185dcb514/action.yaml#L66

Line 118 in 48ef2d3

- uses: actions/checkout@v4

ISSUE-307

ci/dependency-scan

ISSUE-307

ci/security-audit

git-mirror/.github/workflows/kingfisher.yml

Line 78 in 48ef2d3

- uses: actions/checkout@v4

ISSUE-307

kingfisher/kingfisher

Line 40 in 48ef2d3

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

ISSUE-307

plumber/plumber

git-mirror/.github/workflows/plumber.yml

Line 50 in 48ef2d3

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

ISSUE-307

release-please/build_and_upload

Line 63 in 48ef2d3

uses: actions/checkout@v4

ISSUE-307

release-please/create_release

Line 164 in 48ef2d3

uses: actions/checkout@v4

ISSUE-307

release-please/release