Skip to content

fix(deps): update non-major dependencies - #37

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies
Open

fix(deps): update non-major dependencies#37
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/checkout action patch v7.0.0v7.0.1
anyhow dependencies patch 1.0.1011.0.104
aquasecurity/trivy-action action minor v0.35.0v0.36.0
clap dependencies minor 4.5.574.6.6
dialoguer dependencies minor 0.100.12
getplumber/plumber action patch v0.4.8v0.4.40
github/codeql-action (changelog) action digest c4dd10e42947a3
jdx/mise-action action patch v4.2.4v4.2.5
pragent/pr-agent docker digest ea2ea906f5c0ca

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

  • Update syn dev-dependency to version 3

v1.0.103

Compare Source

  • Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

v1.0.102

Compare Source

aquasecurity/trivy-action (aquasecurity/trivy-action)

v0.36.0

Compare Source

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

clap-rs/clap (clap)

v4.6.6

Compare Source

Features
  • Add Command::get_overridden_usage

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal
  • Update to syn v3

v4.6.3

Compare Source

Fixes
  • (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes
  • (help) Say alias when there is only one

v4.6.1

Compare Source

Fixes
  • (derive) Ensure rebuilds happen when an read env variable is changed

v4.6.0

Compare Source

Compatibility
  • Update MSRV to 1.85

v4.5.61

Compare Source

Internal
  • Update dependencies

v4.5.60

Compare Source

Fixes
  • (help) Quote empty default values, possible values

v4.5.59

Compare Source

Fixes
  • Command::ignore_errors no longer masks help/version on subcommands

v4.5.58

Compare Source

console-rs/dialoguer (dialoguer)

v0.12.0: 0.12.0

Compare Source

What's Changed

v0.11.0: 0.11.0

Compare Source

What's Changed

getplumber/plumber (getplumber/plumber)

v0.4.40

Compare Source

🐛 Bug Fixes
  • docker: stamp version metadata into the published image (f88e404), closes #​425
👷 CI/CD
  • release: pin v0.4.39 refs [skip ci] (e93967c)

v0.4.39

Compare Source

🐛 Bug Fixes
  • docker: stamp version metadata into the published image (f88e404), closes #​425
👷 CI/CD
  • release: pin v0.4.39 refs [skip ci] (e93967c)

v0.4.38

Compare Source

✨ Features
  • ci: Add findings control library (8864b2d)
👷 CI/CD
  • release: pin v0.4.38 refs [skip ci] (a5fccb7)

v0.4.37

Compare Source

✨ Features
  • ci: restore the contract platform push, key results by policy_id, act on the gate block (43dd0f8), closes #​410
👷 CI/CD
  • release: pin v0.4.37 refs [skip ci] (c1a149f)

v0.4.36

Compare Source

✨ Features
  • ci: Add --platform feature to integrate pushing of results per policy (d6c5d84)
🐛 Bug Fixes
  • ci: bump Go toolchain to 1.26.6 for stdlib security fixes (73f5ebe)
👷 CI/CD
  • release: pin v0.4.36 refs [skip ci] (77eb302)

v0.4.35

Compare Source

🔧 Chores
  • deps: bump github.com/open-policy-agent/opa (f04befa)
👷 CI/CD
  • release: pin v0.4.35 refs [skip ci] (3b308ff)

v0.4.34

Compare Source

🐛 Bug Fixes
  • config: embed the shipped default in place (a27b4a5), closes #​405
👷 CI/CD
  • release: pin v0.4.34 refs [skip ci] (d4bf27b)

v0.4.33

Compare Source

✨ Features
  • identity: expose the finding-identity recipe and make job mean a job (e7af327), closes #​403
👷 CI/CD
  • release: pin v0.4.33 refs [skip ci] (4a0c59d)

v0.4.32

Compare Source

🐛 Bug Fixes
  • github: normalize SHA case and peel nested tag objects (fbfacde)
  • github: resolve action pins that name an annotated tag object (4016170), closes #​401
⚡ Performance
  • github: skip the tag object probe for refs that cannot be one (eb9c669)
🔧 Chores
  • drop a stray worktree entry committed by mistake (82c947f)
📚 Documentation
  • github: record that the fork blind spot now covers tag objects (4eeee96)
✅ Tests
  • github: lock the collector-to-IR metadata handoff (ccfc59b)
  • github: lock the zero-cost happy path for the tag object fallback (fae517e)
👷 CI/CD
  • release: pin v0.4.32 refs [skip ci] (e84e2c0)

v0.4.31

Compare Source

✨ Features
  • sarif: surface the issue code, doc link and stable alert identity in GHAS (74691c6), closes #​372
👷 CI/CD
  • release: pin v0.4.31 refs [skip ci] (c75127f)

v0.4.30

Compare Source

🔧 Chores
  • ci: bump the github-actions group across 1 directory with 5 updates (c67b731)
👷 CI/CD
  • release: pin v0.4.30 refs [skip ci] (75037fd)

v0.4.29

Compare Source

🐛 Bug Fixes
  • misc: Update various stale documentation and fix incorrect array size in catalog (98b399a)
👷 CI/CD
  • release: pin v0.4.29 refs [skip ci] (72d4610)

v0.4.28

Compare Source

✨ Features
  • artifacts: Add controlName in the outputs + add status for json output + add csv format (c9a08b4)
  • artifacts: stable per-finding fingerprint in JSON, CSV, SARIF, GLSAST (faf7040)
  • cli: add OCSF Compliance Finding export (--ocsf) (9a7ef68)
👷 CI/CD
  • release: pin v0.4.28 refs [skip ci] (0637800)

v0.4.27

Compare Source

🐛 Bug Fixes
  • github: resolve default branch even when branchMustBeProtected is off (3fed560)
👷 CI/CD
  • release: pin v0.4.27 refs [skip ci] (7b8933d)

v0.4.26

Compare Source

🐛 Bug Fixes
  • lint: report all issues instead of golangci-lint's truncated default (cb5739a)
♻️ Refactoring
  • remove 50 dead functions unreachable from main (a28393c)
✅ Tests
  • config: cover GitLab trustedUrls narrowing with includePlumberDefaults to false (46f09ed), closes #​365
👷 CI/CD
  • lint: gate on whole-program dead code detection (0aac54c)
  • release: pin v0.4.26 refs [skip ci] (e461736)

v0.4.25

Compare Source

🐛 Bug Fixes
  • config: trust getplumber/* actions in the shipped default config (771ec58)
👷 CI/CD
  • release: pin v0.4.25 refs [skip ci] (65c0c08)

v0.4.24

Compare Source

✨ Features
  • config: layered .plumber.yaml configuration (17d3fdb), closes #​375
  • defaultconfig: curate the shipped default and source config init from it (aebf2d1), closes #​1
🐛 Bug Fixes
  • control: avoid allocation-size-overflow pattern flagged by CodeQL (c6bca30)
🔧 Chores
  • defaultconfig: simplify the embedded-default build pipeline (f55c7de)
✅ Tests
  • adapt self-scan parity/gating tests to the GitHub-only self-scan config (9c53bc2)
👷 CI/CD
  • release: pin v0.4.24 refs [skip ci] (c90df59)

v0.4.23

Compare Source

🔧 Chores
  • readme: smooth token-free scan wording (8bc4c80)
📚 Documentation
  • readme: tidy config comment and auth wording (b1e4ff7)
👷 CI/CD
  • release: pin v0.4.23 refs [skip ci] (cf6b908)

v0.4.22

Compare Source

✨ Features
  • gitlab: allow an embedding host to inject a shared HTTP client (2579221)
✅ Tests
  • gitlab: integration — a real Fetch collects through the injected client (84e18ee)
👷 CI/CD
  • release: pin v0.4.22 refs [skip ci] (3851e87)

v0.4.21

Compare Source

🔧 Chores
  • ci: bump the github-actions group with 9 updates (2b22f47)
👷 CI/CD
  • release: pin v0.4.21 refs [skip ci] (21941df)

v0.4.20

Compare Source

🐛 Bug Fixes
  • ci: Merge dependabot same type (2d42c8c)
👷 CI/CD
  • release: pin v0.4.20 refs [skip ci] (0fe1eef)

v0.4.19

Compare Source

🐛 Bug Fixes
  • ci: Component version not getting autoamtically bumped. Remove extra text from PR. change default pr names (5b8e3ef)
👷 CI/CD
  • release: pin v0.4.19 refs [skip ci] (9da670e)

v0.4.18

Compare Source

🐛 Bug Fixes
  • ci: PR body when writing to website (5ee0d15)
👷 CI/CD
  • release: pin v0.4.18 refs [skip ci] (e91e449)

v0.4.17

Compare Source

✨ Features
  • ci: Automate component and documentation upgrade (a0fea4a)
👷 CI/CD
  • release: pin v0.4.17 refs [skip ci] (6371abc)

v0.4.16

Compare Source

🐛 Bug Fixes
  • conf: restore gitlab controls in self-scan .plumber.yaml (34a4cbf)
👷 CI/CD
  • release: pin v0.4.16 refs [skip ci] (cbb9172)

v0.4.15

Compare Source

✨ Features
  • output: restructure control output into clear Passed/Skipped/Failed sections (78b576f)
👷 CI/CD
  • release: pin v0.4.15 refs [skip ci] (5ad6b54)

v0.4.14

Compare Source

🐛 Bug Fixes
  • controls: don't score GitHub-only controls on GitLab runs — gate findings by provider applicability so plumberScore.counts matches the rendered controls (#​349) (6cc38ec)
📚 Documentation
  • template: Update comment in template and add version reference section in contributing (5a6ec4e)
👷 CI/CD
  • release: pin v0.4.14 refs [skip ci] (f85f762)

v0.4.13

Compare Source

🐛 Bug Fixes
  • ci: Fix vuln and update grype ref (6607bb8)
👷 CI/CD
  • release: pin v0.4.13 refs [skip ci] (8472496)

v0.4.12

Compare Source

✨ Features
  • cli: fall back to the built-in default config when no .plumber.yaml is found instead of failing, so scans work with zero setup. Remove the redundant config baked into the Docker image and drop the stale 'global config' wording (#​326). (9a1ea62)
👷 CI/CD
  • release: pin v0.4.12 refs [skip ci] (9da2169)

v0.4.11

Compare Source

🐛 Bug Fixes
  • cli: clearer, less noisy terminal output for analyze (f33fe10)
👷 CI/CD
  • release: pin v0.4.11 refs [skip ci] (a24f952)

v0.4.10

Compare Source

✨ Features
  • controls: actionsMustNotExecuteMutableRemoteCode (ISSUE-714/715/716) (4357428), closes #​295
  • github: detect mutable exec in Docker-image actions (18be485)
🐛 Bug Fixes
  • control: emit actionsMustNotExecuteMutableRemoteCode findings in JSON output (ceb92e4)
  • github: cut false positives in actionsMustNotExecuteMutableRemoteCode and gate its source fetch on the control being enabled (#​299) (46ed6c5)
👷 CI/CD
  • release: pin v0.4.10 refs [skip ci] (a7e5614)

v0.4.9

Compare Source

🐛 Bug Fixes
  • cli: render the progress bar only on a TTY, clarify --print vs --verbose semantics, drop dead LogLevel (#​309) (7fbc954)
👷 CI/CD
  • release: pin v0.4.9 refs [skip ci] (4352de9)
jdx/mise-action (jdx/mise-action)

v4.2.5: : Resilient mise downloads with automatic retries

Compare Source

A small patch release that makes setup more resilient to transient network failures when downloading mise.

Fixed
Retry mise downloads after transient failures (#​597 by @​jdx)

The download helpers previously made a single curl or wget attempt, so a transient GitHub release-asset HTTP or TLS failure would abort setup before mise or any user command could run (see #​596).

Downloads now run through a retry wrapper that makes up to five attempts with a 2s pause between failures, logging a warning on each retry. This applies consistently to binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download — never inside the retry loop — so integrity guarantees are unchanged.

Full Changelog: jdx/mise-action@v4.2.4...v4.2.5


Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Comment thread .github/workflows/kingfisher.yml Fixed
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown

🛡️ Plumber — CI/CD Security Compliance

✅ No Critical-severity findings

🟠 High (15)

Code Location Source
ISSUE-701 ci/build
uses: dtolnay/rust-toolchain@stable
ISSUE-701 ci/coverage
uses: dtolnay/rust-toolchain@stable
ISSUE-701 ci/coverage
uses: codecov/codecov-action@v4
ISSUE-701 ci/security-audit
uses: dtolnay/rust-toolchain@stable
ISSUE-701 release-please/build_and_upload
uses: dtolnay/rust-toolchain@stable
ISSUE-701 release-please/release
uses: googleapis/release-please-action@v4
ISSUE-713 ci/build
uses: dtolnay/rust-toolchain@stable
ISSUE-713 ci/coverage
uses: dtolnay/rust-toolchain@stable
ISSUE-713 ci/security-audit
uses: dtolnay/rust-toolchain@stable
ISSUE-713 kingfisher/kingfisher
- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
ISSUE-713 release-please/build_and_upload
uses: dtolnay/rust-toolchain@stable
ISSUE-714 ci/build
uses: dtolnay/rust-toolchain@stable
ISSUE-714 ci/coverage
uses: dtolnay/rust-toolchain@stable
ISSUE-714 ci/security-audit
uses: dtolnay/rust-toolchain@stable
ISSUE-714 release-please/build_and_upload
uses: dtolnay/rust-toolchain@stable

View this run

@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from adac2bb to 1202fc0 Compare August 17, 2026 18:41
fetch-depth: 0 # full history — Kingfisher defaults to --git-history full

- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch from 1202fc0 to b322b5d Compare August 21, 2026 17:58
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch from b322b5d to 06763ce Compare August 22, 2026 22:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant