v1.3.0

• Always point to the commit sha when pinning. The tag sha previously worked but have recently started to fail (#21, #22)

v1.2.0

• Allow consumers to ignore any dependencies that are already pinned with the -i flag (#19)

v1.1.3

• Bump dependencies

v1.1.2

• Fix pinning workflows that have a run step (#9)

v1.1.1

• Update release workflow to ensure release includes the version bump commit

v1.1.0

New

• Add the ability to mark actions as allowed and skip pinning them to a specific SHA (#6)

v1.0.2

New

• Bump vulnerable dependencies
• Add NPM release workflow