[dependabot]

Bumps getplumber/plumber from 0.4.41 to 0.4.62.

Release notes

Sourced from getplumber/plumber's releases.

v0.4.62

0.4.62 (2026-09-12)

🐛 Bug Fixes

• gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
• platform: a served empty include list is complete attribution, not unknown (754ab69)
• platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

• platform: pin the no-attribution branch of the includes served line (9b18a79)
• platform: pin the wire-level decode of resolve response includes (4e2837d)

👷 CI/CD

• release: pin v0.4.61 refs [skip ci] (cc366ec)

v0.4.61

0.4.61 (2026-09-12)

✨ Features

• configuration: export nullable on schema fields so an editor knows when unset is meaningful (6ce3630)
• platform: require --platform-allow-http before sending credentials to a plain-http platform (fe0537c)
• scoring: withhold the score when no control was evaluated (230a389)

🐛 Bug Fixes

• cmd: keep the degraded-collection message ahead of the withheld score (d594e7f)
• scoring: count a finding once per identity so the job and the platform score the same input (ed43bb5)
• utils: strip userinfo from the parsed git remote so a token clone still matches the analyzed project (b571f61)

📚 Documentation

• plans: cli batch 2, platform decision rows 41, 45, 46, 51, 52 (4148d57)

✅ Tests

• cmd: assert the withheld-score gate line when controls exist but none was evaluated (7ecdabc)
• cmd: pin the plain-http refusal on the GitHub analysis path (894a527)

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.4.63 (2026-09-14)

✨ Features

• cmd: push a linked run that evaluated nothing, with the marker the platform records (row 63) (c713d04)
• control: drive platform-mode collection from the union of the resolved policies (row 62) (f318bcb)

🐛 Bug Fixes

• cmd: ignore --controls and --skip-controls on a linked run (row 64) (f93ed94)
• cmd: terminal, exit code and docs follow the policy verdicts on a linked run (row 62) (9b5d4ff)

♻️ Refactoring

• gitlab: export the multi-document CI parser as ParseGitlabCIConf (row 54) (0795790)

👷 CI/CD

• release: pin v0.4.62 refs [skip ci] (1840df4)

0.4.62 (2026-09-12)

🐛 Bug Fixes

• gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
• platform: a served empty include list is complete attribution, not unknown (754ab69)
• platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

• platform: pin the no-attribution branch of the includes served line (9b18a79)
• platform: pin the wire-level decode of resolve response includes (4e2837d)

👷 CI/CD

• release: pin v0.4.61 refs [skip ci] (cc366ec)

0.4.61 (2026-09-12)

✨ Features

• configuration: export nullable on schema fields so an editor knows when unset is meaningful (6ce3630)

... (truncated)

Commits

• 8cb2c2d chore(release): 0.4.62 [skip ci]
• 9b18a79 test(platform): pin the no-attribution branch of the includes served line
• 754ab69 fix(platform): a served empty include list is complete attribution, not unknown
• d370cbd fix(gitremote): eat every userinfo @ up to the last one before the path
• 4e2837d test(platform): pin the wire-level decode of resolve response includes
• dc10a57 fix(platform): use the includes the resolve endpoint serves
• cc366ec ci(release): pin v0.4.61 refs [skip ci]
• 6577ef1 chore(release): 0.4.61 [skip ci]
• d594e7f fix(cmd): keep the degraded-collection message ahead of the withheld score
• 894a527 test(cmd): pin the plain-http refusal on the GitHub analysis path
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #109.