getplumber/plumber

v0.3.101 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

Published 17d Pipelines

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

ci-cd compliance pipeline security

Summary

AI summary

Updates 🐛 Bug Fixes, ✨ Features, and 👷 CI/CD across a mixed release.

Type	Severity	Summary	CVE
Feature	Low	Adds control to check for cache poisoning releaseWorkflowsMustNotRestoreUntrustedCache Adds control to check for cache poisoning releaseWorkflowsMustNotRestoreUntrustedCache Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes false positive/false negative gaps in cache-poisoning control Fixes false positive/false negative gaps in cache-poisoning control Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Fixes init to contain more default values in control Fixes init to contain more default values in control Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

control: Add control to check for cache poisoning releaseWorkflowsMustNotRestoreUntrustedCache (2272c47)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track getplumber/plumber

Get notified when new releases ship.

About getplumber/plumber

v0.4.0 Runs with nothing scoreable now fail closed (exit 1)
v0.4.0 Default artifact name changed to plumber-report
v0.4.0 gate no longer exposes 'compliance'; redefines 'passed' as 'score gate met'