[dependabot]

Bumps getplumber/plumber from 0.4.63 to 0.5.4.

Release notes

Sourced from getplumber/plumber's releases.

v0.5.4

0.5.4 (2026-09-21)

✨ Features

• catalog: export toggle semantics for behavior-switch booleans (46c5014)

👷 CI/CD

• release: pin v0.5.3 refs [skip ci] (a36dcb4)

v0.5.3

0.5.3 (2026-09-19)

🐛 Bug Fixes

• gitlab: a required template matches its identity from the ref, not only its file path (056e7c8)
• gitlab: a versioned template include keeps its template identity when the tag listing fails (724aa10)
• platform: a linked run never calls GitLab for an include the platform served without its observation (d990b31)
• platform: a version fact the platform did not serve reads as platform_observation_missing, not as a failed probe (52e1c47)

👷 CI/CD

• release: pin v0.5.2 refs [skip ci] (cd7ef86)

v0.5.2

0.5.2 (2026-09-18)

✨ Features

• identity: recipe version 6, one identity per rule for ISSUE-405, ISSUE-408 and ISSUE-417 (b4f43ed)
• policies: one finding per rule for missing required templates, components and actions (row 107) (50f6cf7)

👷 CI/CD

• release: pin v0.5.1 refs [skip ci] (0648860)

v0.5.1

0.5.1 (2026-09-17)

🐛 Bug Fixes

• component: run the plumber job on branch pipelines with an open MR and on plumber/ branches (045fe6f), closes #476

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.5.8 (2026-09-23)

🐛 Bug Fixes

• cmd: the bill mirrors the platform's byte and edge bounds, a bill the platform would refuse is omitted whole (d94a6c0)
• gitlab,pbom: a component include carries its project, the bill of materials can key the component (34480c8)

✅ Tests

• cmd: the edge bound is pinned through the services and runner tags terms (review) (7ba89d7)

👷 CI/CD

• release: pin v0.5.7 refs [skip ci] (0dd46fb)

0.5.7 (2026-09-23)

🐛 Bug Fixes

• cmd: the bill's bounds are measured on the wire section, an image naming more than 500 jobs omits the bill (91a74d9)
• cmd: the platform push carries the pipeline bill of materials (bom, schema 1, bounded) (c0f1a21)
• ir,gitlab,pbom: a job carries its runner tags, the bill of materials names each job's services and tags (1d3c9a6)

👷 CI/CD

• release: pin v0.5.6 refs [skip ci] (ab18ada)

0.5.6 (2026-09-22)

🐛 Bug Fixes

• catalog: the control catalog names the gitlab tier a control or a field requires (ask 56) (8130a2c)
• configuration,policies: the default branch is a forbidden include version by default, mr fields lose descriptions (50a60b0)
• control,configuration: CTRL-102 is named container images must not use forbidden reference, the name copies agree (7ebbb6a)
• policies: every gitlab finding message reads as one clear sentence with its technical tokens quoted (c298ed0)

✅ Tests

• policies: every rewritten label and message branch is rendered by the corpus, ISSUE-506 labels are complete (18d0215)
• policies: the ISSUE-502 and ISSUE-601 message branches are asserted, the lint rejects empty backquotes (9abef9a), closes #484
• policies: the ISSUE-505 reasons are asserted and every string array in finding data passes the lint (c684a76)
• policies: the squash clause of ISSUE-506 and every ISSUE-413 detail branch render through the lint (3ec811e)

... (truncated)

Commits

• 21d6a4e chore(release): 0.5.4 [skip ci]
• 46c5014 feat(catalog): export toggle semantics for behavior-switch booleans
• a36dcb4 ci(release): pin v0.5.3 refs [skip ci]
• d6a09a8 chore(release): 0.5.3 [skip ci]
• 52e1c47 fix(platform): a version fact the platform did not serve reads as platform_ob...
• 056e7c8 fix(gitlab): a required template matches its identity from the ref, not only ...
• 724aa10 fix(gitlab): a versioned template include keeps its template identity when th...
• d990b31 fix(platform): a linked run never calls GitLab for an include the platform se...
• cd7ef86 ci(release): pin v0.5.2 refs [skip ci]
• d37150c chore(release): 0.5.2 [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #114.