getplumber/plumber

v0.3.28 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 2d Pipelines

✓ No known CVEs patched

✓ No known CVEs patched in this version

Affected surfaces

auth

Summary

AI summary

Fixed trustedUrls scoping for curl/wget fetch targets and corrected bare‑hostname matching.

Type	Severity	Summary	CVE
Bugfix	Medium	Fixes trustedUrls scope for curl/wget fetch target in controls. Fixes trustedUrls scope for curl/wget fetch target in controls. Source: llm_adapter@2026-06-01 Confidence: high	—
Bugfix	Medium	Fixes trustedUrls bare-hostname matching and partial semver false positives in controls. Fixes trustedUrls bare-hostname matching and partial semver false positives in controls. Source: llm_adapter@2026-06-01 Confidence: high	—

Full changelog

controls: scope ISSUE-411 trustedUrls to the curl/wget fetch target (3541e75), closes #214
controls: trustedUrls bare-hostname matching and partial semver false positives (a7975cd)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track getplumber/plumber

Get notified when new releases ship.

About getplumber/plumber