getplumber/plumber

v0.4.0 Breaking

This release includes 3 breaking changes for platform teams planning a safe upgrade.

Published 16d Pipelines

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ci-cd compliance pipeline security

Affected surfaces

auth rbac breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 11d

In gate v0.4.0 the 'compliance' field is removed from JSON reports and GitHub Action outputs, and the meaning of 'passed' has been redefined to indicate that a score gate condition is satisfied.

Why it matters: Gate no longer exposes 'compliance'; 'passed' now means only that the score gate met. Update integrations consuming these fields before upgrading to v0.4.0.

Summary

AI summary

Updates 👷 CI/CD, ⚠ BREAKING CHANGES, and ✨ Features across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Breaking
Breaking	High	gate no longer exposes 'compliance'; redefines 'passed' as 'score gate met' gate no longer exposes 'compliance'; redefines 'passed' as 'score gate met' Source: llm_adapter@2026-07-15 Confidence: low	—
Breaking	High	Default artifact name changed to plumber-report Default artifact name changed to plumber-report Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Breaking	High	Runs with nothing scoreable now fail closed (exit 1) Runs with nothing scoreable now fail closed (exit 1) Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Medium	gate now runs on the Plumber Score, dropping compliance percentage gate now runs on the Plumber Score, dropping compliance percentage Source: llm_adapter@2026-07-15 Confidence: low	—

Full changelog

0.4.0 (2026-07-10)

⚠ BREAKING CHANGES

gate: the JSON report and the GitHub Action no longer expose
'compliance'; 'passed' is redefined as 'score gate met'; the default
artifact name changed to plumber-report. Runs with nothing scoreable
now fail closed (exit 1): on GitHub, a repository with no workflows
previously passed the compliance gate and now fails, and a
configuration that enables zero controls for the scanned provider (or
a skip-all filter) also fails instead of passing with a perfect
score. Skip Plumber or use soft-fail on repos that intentionally have
no CI.

✨ Features

gate: gate runs on the Plumber Score, drop the compliance percentage (2bd2639), closes #320 #320

👷 CI/CD

claude: use claude-opus-4-8 for PR review checks (0c65684)
release: pin v0.3.101 refs [skip ci] (e209f31)

Breaking Changes

Gate JSON report and GitHub Action no longer expose 'compliance'; 'passed' redefined as 'score gate met'.
Default artifact name changed to plumber-report.
Runs with nothing scoreable now fail closed (exit code 1); repositories without workflows or with zero controls now cause failure instead of passing.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track getplumber/plumber

Get notified when new releases ship.

About getplumber/plumber

All releases →