chore(deps): bump pullfrog/pullfrog from 0.1.95 to 0.1.98 in the patch-minor group

[dependabot]

Bumps the patch-minor group with 1 update: pullfrog/pullfrog.

Updates pullfrog/pullfrog from 0.1.95 to 0.1.98

Release notes

Sourced from pullfrog/pullfrog's releases.

v0.1.98

📦 pullfrog 0.1.98

Usage in GitHub Actions

- uses: pullfrog/pullfrog@v0

Installation via npm

npm install pullfrog@0.1.98

v0.1.97

📦 pullfrog 0.1.97

Usage in GitHub Actions

- uses: pullfrog/pullfrog@v0

Installation via npm

npm install pullfrog@0.1.97

Commits

• ad4283a release: bump action to 0.1.98
• e1f3599 deps: pin claude-code 2.1.293 so the Claude harness knows Haiku 5.5 (#1498)
• 99490b6 chore(models): bump claude-haiku to Haiku 5.5 (#1494)
• 5477fb6 models: add Zen's free Step 5 Preview, hidden until a release carries it (#1497)
• 3379c27 models: retire Fledge Alpha onto Big Pickle (#1496)
• d561465 models: give openrouter/claude-haiku Haiku 5.5's effort ladder (#1492)
• 5fe4547 action: add security@pullfrog.com to SECURITY.md
• d651f20 action: add SECURITY.md pointing to private vulnerability reporting
• f0684f2 release: bump action to 0.1.97
• 086a10f fix: 9 unaddressed log-audit / run-audit findings (#1480)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[pullfrog]

Checked PR #177. The diff is one line in .github/workflows/pullfrog.yml. It moves the pullfrog/pullfrog pin from ed800018… (v0.1.95) to ad4283a862b8377cb525a0f5bf30f17c023b18ea (v0.1.98). That SHA matches the target of the compare link in the PR body, and the pin is still a full commit SHA with a version comment.

The upstream changes for 0.1.96 to 0.1.98 are model catalog updates, a pinned claude-code version and a SECURITY.md. None of them touch the prompt and model: anthropic/claude-sonnet inputs this workflow passes. I didn't run the updated action. I found nothing that blocks merging, and I made no code changes.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using claude-sonnet-5-5 ｜ 𝕏}