build(deps): bump bact/pitloom from 0.17.0 to 0.19.0

[dependabot]

Bumps bact/pitloom from 0.17.0 to 0.19.0.

Release notes

Sourced from bact/pitloom's releases.

v0.19.0

This release makes the GitHub Action honour its pin. uses: bact/pitloom@v0.19.0 (or a commit SHA) now installs that Pitloom version from PyPI instead of the latest release. pitloom-version still overrides it.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Flit, Hatchling, PDM, Poetry, setuptools, and uv_build projects. Support for build with compiled artefacts (maturin, scikit-build-core, meson-python) is in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Make GitHub Action honour its pinned ref and the workflow's Python by @​bact in bact/pitloom#224

Full Changelog: bact/pitloom@v0.18.1...v0.19.0

v0.18.1

This release fixes compatibility with Hatchling 1.32.3's breaking change, while maintains compatibility with Hatchling >= 1.29.0. It also expands Claude Code skill coverage.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Flit, Hatchling, PDM, Poetry, setuptools, and uv_build projects. Support for build with compiled artefacts (maturin, scikit-build-core, meson-python) is in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Add FragmentConfig and loom fragment list by @​bact in bact/pitloom#217
• Split fasttext dependency by Python version to fix Windows build by @​bact in bact/pitloom#220
• Fix Hatchling build hook crash on Hatchling >=1.32.3 by @​bact in bact/pitloom#222

... (truncated)

Changelog

Sourced from bact/pitloom's changelog.

---

Last-Modified: 2026-09-21 SPDX-FileCopyrightText: 2026-present Arthit Suriyawongkul SPDX-FileType: DOCUMENTATION SPDX-License-Identifier: CC0-1.0

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

• Full release notes: https://github.com/bact/pitloom/releases
• Commit history: bact/pitloom@v0.18.1...v0.19.0

[Unreleased]

Added

• --build-timeout DURATION for --allow-build (CLI, Action input, library BuildOptions.timeout); default 20m, max 7 days; falls back to static discovery on expiry (#226)
• content_type_method parameter on generate_wheel_sbom(), generate_env_sbom() and build_deployed() (#228)
• pitloom.core.config_cascade: ConfigOverrides (moved from pitloom.embed, still re-exported), apply_overrides() (was pitloom.embed._apply_config_overrides), load_config_file() and resolve_standalone_config() (#228, #231)
• --config FILE CLI flag / pitloom_config= library parameter on every SBOM command and generator function, and embed_wheel_sbom(); replaces the target's own [tool.pitloom] rather than merging with it (#231)
• max_source_metadata_bytes= parameter on generate(), generate_wheel_sbom(), generate_env_sbom() and generate_model_sbom() (#231)
• WARNING: Options: <subject>: <flag> has no effect <reason> for a shared flag given on a target that cannot act on it, keyed by target kind (pitloom.core.inert_options.INERT) (#231)

Changed

• Library API: allow_build/no_build_isolation kwargs replaced by one build_options=BuildOptions(...); ignored build flags now warn once on every surface (#226)

... (truncated)

Commits

• 3c555bf Merge pull request #225 from bact/bump-0.19.0
• 58454cd Bump version to 0.19.0
• 7d4ac29 Merge pull request #224 from bact/pin-github-action
• 5f2951e Fix stderr in action
• fb37f39 Fix action.yml
• a7ef482 Update docs
• 34f2227 Fix command in action.yml
• cc31283 Make GitHub Action honour its pinned ref and the workflow's Python
• 9812b84 Update working-docs
• 6a5473c Update CHANGELOG.md
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.