All pull requests

Pull requests

• fix(cli): preserve project path before --report

  #1525·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  3

• fix(cli): reject empty --report= value

  #1524·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  3

• fix(sarif): deriveLockfileUri emits bun.lock instead of unsupported bun.lockb

  #1521·muntasir-396 opened Nov 4, 2026Contributor·

  ·
  1

  1

• fix(cli): validate --min-severity values and reject unrecognised levels

  #1520·muntasir-396 opened Nov 4, 2026Contributor·

  ·
  1

  1

• fix(cli): reject empty = value for --sbom instead of reporting unknown format

  #1517·muntasir-396 opened Nov 4, 2026Contributor·

  ·
  1

  1

• fix(parsers): choose a nested lockfile by the root rules

  #1515·sonukapoor opened Nov 4, 2026Collaborator·

  ·
  1

  4

• fix: detect the promised copyleft families

  #1513·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  1

• fix: read the resolved version's registry license

  #1512·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  3

• fix(licenses): honor production-only npm scans

  #1511·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  2

• fix: use shared gate labels in multi-folder scan

  #1507·anatbimblich opened Nov 4, 2026·

  ·
  1

  2

• ci(spdx): validate SPDX SBOM with official spdx-tools validator in CI

  #1504·Nachiket-Roy opened Nov 3, 2026Contributor·

  ·
  1

  6

• fix(cli): reject missing or unknown advisories subcommand instead of scanning it as directory

  #1502·muntasir-396 opened Nov 3, 2026Contributor·

  ·
  1

  3

• refactor: extract type-query signature scanning pass

  #1500·vianmangal opened Nov 3, 2026Contributor·

  ·
  1

• refactor: centralize npm lockfile selection

  #1499·vianmangal opened Nov 3, 2026Contributor·

  ·
  6

• fix: suppress option-shaped package names in fix commands

  needs triage
  #1493·S3DFX-CYBER opened Nov 3, 2026·

  ·
  1

  17

• docs: clarify dependency metadata sent during online scans

  #1489·ahmed-sherif-hassona opened Nov 3, 2026·

  ·
  1

  5

• feat(cyclonedx): emit component.scope for dev and prod dependencies

  #1488·Nachiket-Roy opened Nov 2, 2026Contributor·

  ·
  8

• fix: preserve last good advisory DB on failed refresh

  #1483·vianmangal opened Nov 2, 2026Contributor·

  ·
  1

  34

• fix(output): centralize terminal routing to stderr and explain failed gates (#1465)

  #1468·bhushan4work opened Nov 1, 2026Contributor·

  ·
  1

  17

• fix(osv): retry failed advisory detail lookups and fall back to cached details

  #1456·sonukapoor opened Oct 30, 2026Collaborator·

  ·
  1

  25

• ci: fail the test type-check when a source change breaks an unchanged test (#1364)

  #1451·prx-my opened Oct 30, 2026Contributor·

  ·
  1

  28

• fix: report safe install error codes during --fix

  #1436·luojiyin1987 opened Oct 28, 2026Collaborator·

  ·
  1

  71

• feat(versions): check PEP 440 ordering against packaging

  #1434·alex-powell opened Oct 27, 2026Contributor·

  ·
  28

• fix(cli): reject flags as --base branch values

  #1431·vianmangal opened Oct 27, 2026Contributor·

  ·
  1

  5

• feat(scan): add --timeout and preserve partial findings

  #1424·bhushan4work opened Oct 27, 2026Contributor·2 tasks done·

  ·
  1

  41