Skip to content

v0.18.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 21:17
· 33 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.18.0
This tag was signed with the committer’s verified signature.
rvben Ruben J. Jongejan
SSH Key Fingerprint: zxkM+AXAzArV/EXZdjJzr/U0l6ASO7y5OrEV+9GvsNw
Verified
Learn about vigilant mode.
3305eb2
This commit was signed with the committer’s verified signature.
rvben Ruben J. Jongejan
SSH Key Fingerprint: zxkM+AXAzArV/EXZdjJzr/U0l6ASO7y5OrEV+9GvsNw
Verified
Learn about vigilant mode.

0.18.0 - 2026-10-24

Changed

  • Breaking: dependency-health publication now requires caller-approved
    allowed-paths (default: existing workflow YAML files). Cargo, npm and other
    manifest/lockfile callers must explicitly list their intended files.
  • Publication uses an independent publisher-runner input, with hosted runners
    remaining the default; disposable homelab publishers require admission before
    job initialization.

Fixed

  • Reject build-selected publication bases, staged validation mutations and
    workflow edits beyond action refs matching an upstream release tag.
  • Isolate downloaded evidence and revoke broker tokens after publication.
Assets 16
Loading