Skip to content

deps/gha: bump getplumber/plumber from 0.7.4 to 0.7.12 - #136

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/github_actions/dev/getplumber/plumber-0.7.12
Closed

dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/github_actions/dev/getplumber/plumber-0.7.12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps getplumber/plumber from 0.7.4 to 0.7.12.

Release notes

Sourced from getplumber/plumber's releases.

v0.7.12

0.7.12 (2026-10-26)

🐛 Bug Fixes

  • github,policies: point GitHub findings at the line that fired (ad8f505), closes #572 #573
  • policies: one line per identity, and the image line for ISSUE-101 (d872c33), closes #572 #572

✅ Tests

  • github: a called job's resolved images keep no line (7c3effa), closes #572
  • policies: pin each line source of ISSUE-209 and ISSUE-309 (b974fd6), closes #572

v0.7.11

0.7.11 (2026-10-21)

✨ Features

  • control,github: a workflow lockfile pins steps, not reusable workflows (07984e2), closes gh-actions-lock#194 #542
  • control,github: ISSUE-701 accepts a tag backed by an immutable release (9db85c9), closes #421

🔧 Chores

  • ci: bump the github-actions group with 5 updates (418f3fd)

📚 Documentation

  • control: a lockfile's presence is enough, GitHub enforces its coverage (7272b17), closes #567 #542 #542

✅ Tests

  • cmd: cover sort and dedup of immutable release refs (a05b314)

v0.7.10

0.7.10 (2026-10-21)

🔧 Chores

  • deps: bump golang.org/x/term (2860509)

v0.7.9

0.7.9 (2026-10-19)

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.7.16 (2026-10-28)

✨ Features

  • cmd: the platform push carries the GitHub bill of materials (a2bcd78)

🐛 Bug Fixes

  • cmd: no GitHub bill of materials when a workflow file does not parse (a88ce02)

0.7.15 (2026-10-28)

🐛 Bug Fixes

  • configuration: eight GitLab-shaped controls declare GitLab only, their GitHub bench entries go (5c78ee5)

0.7.14 (2026-10-27)

🐛 Bug Fixes

  • release: only file a remove/drop first word under Removed (f16eafd)

👷 CI/CD

  • release: GitLab component notes only list what changed in the component (2ebb420), closes #569

0.7.13 (2026-10-27)

🐛 Bug Fixes

  • control,github: judge uses: docker:// step images like container images (c4a2e9a), closes #571
  • pbom: a docker:// step is an image, not an action include (124fae4), closes #575 #571 #571
  • pbom: list the images of nested docker:// steps (b7db988), closes #575 #571

0.7.12 (2026-10-26)

🐛 Bug Fixes

  • github,policies: point GitHub findings at the line that fired (ad8f505), closes #572 #573
  • policies: one line per identity, and the image line for ISSUE-101 (d872c33), closes #572 #572

✅ Tests

... (truncated)

Commits
  • 7e58101 chore(release): 0.7.12 [skip ci]
  • 7c3effa test(github): a called job's resolved images keep no line
  • b974fd6 test(policies): pin each line source of ISSUE-209 and ISSUE-309
  • d872c33 fix(policies): one line per identity, and the image line for ISSUE-101
  • ad8f505 fix(github,policies): point GitHub findings at the line that fired
  • d1133cd chore(release): 0.7.11 [skip ci]
  • 418f3fd chore(ci): bump the github-actions group with 5 updates
  • 7272b17 docs(control): a lockfile's presence is enough, GitHub enforces its coverage
  • 07984e2 feat(control,github): a workflow lockfile pins steps, not reusable workflows
  • a05b314 test(cmd): cover sort and dedup of immutable release refs
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [getplumber/plumber](https://github.com/getplumber/plumber) from 0.7.4 to 0.7.12.
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@cd1ecdf...7e58101)

---
updated-dependencies:
- dependency-name: getplumber/plumber
  dependency-version: 0.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 29, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #137.

@dependabot dependabot Bot closed this Oct 30, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/dev/getplumber/plumber-0.7.12 branch October 30, 2026 08:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant