Skip to content

build(deps): bump getplumber/plumber from 0.5.20 to 0.6.0 - #4

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/getplumber/plumber-0.6.0
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/getplumber/plumber-0.6.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown

Bumps getplumber/plumber from 0.5.20 to 0.6.0.

Release notes

Sourced from getplumber/plumber's releases.

v0.6.0

0.6.0 (2026-10-08)

⚠ BREAKING CHANGES

  • analyze: score letters, --min-score and --min-points gates and badges now read the contextual score. Run with --score-profile v3 or set PLUMBER_ANALYZE_SCORE_PROFILE=v3 to keep the previous formula.

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com Claude-Session: https://claude.ai/code/session_01Ft8dmcMLK7V9XZh7JX4vzs

✨ Features

  • analyze: the contextual score is the default, on every output, with the labelled corpus and the migration report (41eff60)
  • situation: job facts for attack paths, entry subjects, push trigger filters and cache inheritance (89f30e4)

v0.5.24

0.5.24 (2026-10-08)

✨ Features

  • config: exempt dependabot actions from the pin-by-SHA default (834d9c4)

📚 Documentation

  • readme: add Outscale and Telstra to the adopters row (428a960)

✅ Tests

  • control: pin the shipped pin-by-SHA trust boundary to GitHub-owned orgs (ec5c1ef), closes #531

v0.5.23

0.5.23 (2026-10-07)

✨ Features

  • config: trust jfrog-fastci actions in the default allowlist (4b55d04)

v0.5.22

0.5.22 (2026-10-07)

✨ Features

  • config: trust CodSpeedHQ actions in the default allowlist (27f0d74)

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.6.1 (2026-10-12)

✨ Features

  • conf: trust Plumber's own GitLab component by default (b400431)
  • controls: components and functions must come from authorized sources (b2bb03a)
  • gitlab: collect run: step functions and the registry host in the IR (59c9ddd)
  • score: component and function sources in the contextual score (44c5d28)

🐛 Bug Fixes

  • build: move to the Go 1.26.9 toolchain (6449f05)

0.6.0 (2026-10-08)

⚠ BREAKING CHANGES

  • analyze: score letters, --min-score and --min-points gates and badges now read the contextual score. Run with --score-profile v3 or set PLUMBER_ANALYZE_SCORE_PROFILE=v3 to keep the previous formula.

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com Claude-Session: https://claude.ai/code/session_01Ft8dmcMLK7V9XZh7JX4vzs

✨ Features

  • analyze: the contextual score is the default, on every output, with the labelled corpus and the migration report (41eff60)
  • situation: job facts for attack paths, entry subjects, push trigger filters and cache inheritance (89f30e4)

0.5.24 (2026-10-08)

✨ Features

  • config: exempt dependabot actions from the pin-by-SHA default (834d9c4)

📚 Documentation

  • readme: add Outscale and Telstra to the adopters row (428a960)

✅ Tests

  • control: pin the shipped pin-by-SHA trust boundary to GitHub-owned orgs (ec5c1ef), closes #531

0.5.23 (2026-10-07)

... (truncated)

Commits
  • d3536ba chore(release): 0.6.0 [skip ci]
  • 41eff60 feat(analyze)!: the contextual score is the default, on every output, with th...
  • 89f30e4 feat(situation): job facts for attack paths, entry subjects, push trigger fil...
  • ad42e1a chore(release): 0.5.24 [skip ci]
  • ec5c1ef test(control): pin the shipped pin-by-SHA trust boundary to GitHub-owned orgs
  • 834d9c4 feat(config): exempt dependabot actions from the pin-by-SHA default
  • 428a960 docs(readme): add Outscale and Telstra to the adopters row
  • 326eb09 chore(release): 0.5.23 [skip ci]
  • 4b55d04 feat(config): trust jfrog-fastci actions in the default allowlist
  • 950306e chore(release): 0.5.22 [skip ci]
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [getplumber/plumber](https://github.com/getplumber/plumber) from 0.5.20 to 0.6.0.
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@fb943e4...d3536ba)

---
updated-dependencies:
- dependency-name: getplumber/plumber
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 14, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Author

Superseded by #5.

@dependabot dependabot Bot closed this Oct 20, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/getplumber/plumber-0.6.0 branch October 20, 2026 23:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants