v0.18.0

Changelog for poutine v0.18.0 🎉

We're delighted to roll out poutine v0.18.0! This release is packed adds some cool new rule and small enhancements.

Major New Rule 🌟🌟

• 🛡️ New Confused Deputy Auto-Merge Rule: Introduced a new security rule to detect potential Confused Deputy vulnerabilities related to auto-merge workflows, contributed by @fproulx-boostsecurity. (#304)
• Checkout the rule's documentation
• And read the blog article to learn more about this vulnerability class.

Improvements 🔧

• ✨ CLI and Config File include Option: You can now specify an include option in both the CLI and configuration file for more granular control over scanned paths, introduced by @Talgarr. (#289)
• 🏃 Support for Large Ubuntu and Windows Runners: Added capability to utilize larger GitHub-hosted runners for Ubuntu and Windows, enhancing CI flexibility, by @Talgarr. (#293)
• ⚙️ GitHub Actions Strategy Matrix Parsing: Enhanced parsing capabilities for GitHub Actions strategy matrices, implemented by @SUSTAPLE117. This PR also includes various dependency updates. (#301)
• 🛠️ Core Refactoring: Significant refactoring of internal components for improved maintainability and performance, by @Talgarr. (#291)
• 🧩 Enhanced Extensibility: Exported additional fields to simplify the development of extensions and integrations with poutine, thanks to @Talgarr. (#292)
• 📢 Clearer Git Ref Error Reporting: Implemented more specific error messages when a Git reference is unreachable, improving debuggability, by @SUSTAPLE117. (#302)
• 📝 README Typo Correction: Fixed a typo in the README documentation (--scm-base-uri to --scm-base-url), thanks to @natcl. (#303)

Dependency Updates ⬆️

GitHub Actions

• Updated actions/dependency-review-action from 4.5.0 to 4.6.0. (#294)
• Updated sigstore/cosign-installer from 3.7.0 to 3.8.2. (#295)
• Updated actions/upload-artifact from 4.6.0 to 4.6.2. (#296)
• Updated actions/setup-go from 5.3.0 to 5.4.0. (#297)
• Updated github/codeql-action from 3.28.13 to 3.28.16. (#298)

New Contributors 👋

• Welcome @natcl, who made their first contribution by fixing a typo in our README (#303)! We appreciate your attention to detail!

Full Changelog 📜

For a detailed view of all changes, see the full changelog.