Skip to content

deps/gha: bump getplumber/plumber from 0.7.4 to 0.7.18 - #139

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/github_actions/dev/getplumber/plumber-0.7.18
Closed

dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/github_actions/dev/getplumber/plumber-0.7.18

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps getplumber/plumber from 0.7.4 to 0.7.18.

Release notes

Sourced from getplumber/plumber's releases.

v0.7.18

0.7.18 (2026-11-02)

✨ Features

  • report: cliVersion, configFileSha256 and the Actions run in the JSON report (fdd8faf)
  • score: a keyless Sigstore signer for the score push on GitHub Actions (f341aee)
  • score: PLUMBER_SCORE_PAYLOAD_OUT writes the exact pushed bytes (c93d1ce)
  • score: the score push carries the Sigstore bundle, a signing failure only warns (9d5a738)

📚 Documentation

  • score: the signed score push, the provenance keys and PLUMBER_SCORE_PAYLOAD_OUT (602acc3)

v0.7.17

0.7.17 (2026-10-30)

🐛 Bug Fixes

  • cmd: the SARIF names a nested finding's container in its message, never in a location outside the checkout (5b53f2b)

v0.7.16

0.7.16 (2026-10-28)

✨ Features

  • cmd: the platform push carries the GitHub bill of materials (a2bcd78)

🐛 Bug Fixes

  • cmd: no GitHub bill of materials when a workflow file does not parse (a88ce02)

v0.7.15

0.7.15 (2026-10-28)

🐛 Bug Fixes

  • configuration: eight GitLab-shaped controls declare GitLab only, their GitHub bench entries go (5c78ee5)

v0.7.14

0.7.14 (2026-10-27)

🐛 Bug Fixes

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.7.19 (2026-11-05)

🐛 Bug Fixes

  • github: a composite step a literal input turns off is not analyzed (eab2f54), closes #591

📚 Documentation

  • document the workflow lockfile and give it a code owner entry (665cfc5)

👷 CI/CD

  • lock workflow actions and verify the lockfile on PRs (6c31fa3)
  • score: publish the Plumber Score with the released action, the source build no longer pushes (c78b489)
  • verify the workflow lockfile with gh-actions-lock v0.3.0 (e11334e)
  • verify the workflow lockfile with gh-actions-lock v0.4.0 (247fced)

0.7.18 (2026-11-02)

✨ Features

  • report: cliVersion, configFileSha256 and the Actions run in the JSON report (fdd8faf)
  • score: a keyless Sigstore signer for the score push on GitHub Actions (f341aee)
  • score: PLUMBER_SCORE_PAYLOAD_OUT writes the exact pushed bytes (c93d1ce)
  • score: the score push carries the Sigstore bundle, a signing failure only warns (9d5a738)

📚 Documentation

  • score: the signed score push, the provenance keys and PLUMBER_SCORE_PAYLOAD_OUT (602acc3)

0.7.17 (2026-10-30)

🐛 Bug Fixes

  • cmd: the SARIF names a nested finding's container in its message, never in a location outside the checkout (5b53f2b)

0.7.16 (2026-10-28)

✨ Features

  • cmd: the platform push carries the GitHub bill of materials (a2bcd78)

... (truncated)

Commits
  • ebc213a chore(release): 0.7.18 [skip ci]
  • 602acc3 docs(score): the signed score push, the provenance keys and PLUMBER_SCORE_PAY...
  • c93d1ce feat(score): PLUMBER_SCORE_PAYLOAD_OUT writes the exact pushed bytes
  • 9d5a738 feat(score): the score push carries the Sigstore bundle, a signing failure on...
  • f341aee feat(score): a keyless Sigstore signer for the score push on GitHub Actions
  • fdd8faf feat(report): cliVersion, configFileSha256 and the Actions run in the JSON re...
  • 2342834 chore(release): 0.7.17 [skip ci]
  • 5b53f2b fix(cmd): the SARIF names a nested finding's container in its message, never ...
  • e9ad2dc chore(release): 0.7.16 [skip ci]
  • a88ce02 fix(cmd): no GitHub bill of materials when a workflow file does not parse
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [getplumber/plumber](https://github.com/getplumber/plumber) from 0.7.4 to 0.7.18.
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@cd1ecdf...ebc213a)

---
updated-dependencies:
- dependency-name: getplumber/plumber
  dependency-version: 0.7.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #141.

@dependabot dependabot Bot closed this Nov 9, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/dev/getplumber/plumber-0.7.18 branch November 9, 2026 08:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant