lukaszraczylo/traefikoidc erreicht einen Gesundheitsindex von 84 von 100 und liegt damit im Bereich Exzellent. Am stärksten schneidet es bei Vitality (88/100) ab, am schwächsten bei Community & Adoption (53/100). Zuletzt vor 1 Tag aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
84
gesamt / 100
Exzellent
Software-Gesundheitsindex
Metriken werden auf einer standardisierten Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr gewichtetes Mittel, kalibriert auf die Verteilung des öffentlichen Registers, sodass die Stufen Perzentilbedeutung tragen; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze Gefährdet von 34.
84
Außergewöhnlich93-100Die Spitzengruppe des Registers (≈ obere 5 %); erfüllt im Wesentlichen alle geprüften Kriterien
Gut65-79Gesund; Lücken sind begrenzt und beherrschbar
Mittel50-64Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Schwach35-49Wesentliche Schwächen in mehreren Bereichen
Gefährdet20-34Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-19Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Der gewichtete Gesamtwert 71 wird auf der veröffentlichten Indexskala auf 84 kalibriert (Register-Kalibrierung 2026-08-02).
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Liefert Releases aus — 100 Releases veröffentlicht
36/36
Release-Aktualität — letztes Release vor 10 Tagen
27/27
Release-Rhythmus — ein Release etwa alle 6,7 Tage
0/10
OpenSSF Scorecard: Signed-Releases — keine Daten
Verwendete Eingangsdaten
releases_count
100
latest_release_tag
v1.0.29
releases_from_tags
nein
days_since_latest_release
10
mean_days_between_releases
6,7
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Direkte Abhängigkeiten ohne bekannte Advisories — keine direkte Abhängigkeit trägt ein bekanntes Advisory
0/25
Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar
0/40
Keine offenen Advisories — kein Advisory trägt ein Veröffentlichungsdatum
Verwendete Eingangsdaten
source
osv
advisories
0
affected_packages
0
assessed_packages
14
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories, Keine offenen Advisories. Die verbleibenden Gewichte wurden renormalisiert. 14 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Trägt ein bewusst kleines Gewicht (4 %): Agenten-Tooling ist ein echtes Pflegesignal, doch ein Repository ohne jedes Signal kann weiterhin 100/100 erreichen.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 28 ⇿
0Sterne
28Forks
100Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 2Patch 58
Jeder Punkt umfasst 2 Tage.
OpenSSF Scorecard 5.4 / 10
5.4Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-08-01 21:37 UTC
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 7 direkte und 7 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
Registry
Paket
Version
Beziehung
Go
github.com/alicebob/miniredis/v2
v2.35.0
direkt
Go
github.com/gorilla/sessions
v1.3.0
direkt
Go
github.com/lukaszraczylo/oss-telemetry
v0.2.3
direkt
Go
github.com/redis/go-redis/v9
v9.17.2
direkt
Go
github.com/stretchr/testify
v1.10.0
direkt
Go
golang.org/x/time
v0.14.0
direkt
Go
gopkg.in/yaml.v3
v3.0.1
direkt
Go
github.com/cespare/xxhash/v2
v2.3.0
indirekt
Go
github.com/davecgh/go-spew
v1.1.1
indirekt
Go
github.com/dgryski/go-rendezvous
v0.0.0-20200823014737-9f7001d12a5f
indirekt
Go
github.com/gorilla/securecookie
v1.1.2
indirekt
Go
github.com/pmezard/go-difflib
v1.0.0
indirekt
Go
github.com/stretchr/objx
v0.5.2
indirekt
Go
github.com/yuin/gopher-lua
v1.1.1
indirekt
Abhängigkeits-Advisories 0
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 14 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 0 tragen bekannte Advisories, davon 0 direkte.
Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"traefik-plugin",
"traefik-plugin-catalog",
"traefik-auth0",
"traefik-oidc"
],
"is_fork": false,
"size_kb": 3997,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 2944585,
"Shell": 2870,
"Makefile": 2595
},
"pushed_at": "2026-07-31T09:04:47Z",
"created_at": "2024-04-06T23:49:39Z",
"owner_type": "User",
"updated_at": "2026-08-01T11:04:24Z",
"description": "Traefik OIDC plugin middleware",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "raczylo.com",
"name": "Lukasz Raczylo",
"type": "User",
"login": "lukaszraczylo",
"company": null,
"location": "London, United Kingdom",
"followers": 79,
"avatar_url": "https://avatars.githubusercontent.com/u/2182556?v=4",
"created_at": "2012-08-20T10:06:25Z",
"is_verified": null,
"public_repos": 195,
"account_age_days": 5094
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.0.29",
"kind": "patch",
"published_at": "2026-07-22T09:33:59Z"
},
{
"tag": "v1.0.28",
"kind": "patch",
"published_at": "2026-07-21T12:07:24Z"
},
{
"tag": "v1.0.27",
"kind": "patch",
"published_at": "2026-06-26T10:52:34Z"
},
{
"tag": "v1.0.26",
"kind": "patch",
"published_at": "2026-05-30T13:13:16Z"
},
{
"tag": "v1.0.25",
"kind": "patch",
"published_at": "2026-05-30T12:26:33Z"
},
{
"tag": "v1.0.23",
"kind": "patch",
"published_at": "2026-05-27T20:44:01Z"
},
{
"tag": "v1.0.22",
"kind": "patch",
"published_at": "2026-05-24T23:19:11Z"
},
{
"tag": "v1.0.21",
"kind": "patch",
"published_at": "2026-05-23T12:08:07Z"
},
{
"tag": "v1.0.20",
"kind": "patch",
"published_at": "2026-05-23T11:41:46Z"
},
{
"tag": "v1.0.19",
"kind": "patch",
"published_at": "2026-05-23T11:25:47Z"
},
{
"tag": "v1.0.18",
"kind": "patch",
"published_at": "2026-05-23T10:35:06Z"
},
{
"tag": "v1.0.17",
"kind": "patch",
"published_at": "2026-05-23T10:26:41Z"
},
{
"tag": "v1.0.16",
"kind": "patch",
"published_at": "2026-05-23T10:08:27Z"
},
{
"tag": "v1.0.15",
"kind": "patch",
"published_at": "2026-05-23T09:50:32Z"
},
{
"tag": "v1.0.14",
"kind": "patch",
"published_at": "2026-05-23T01:39:09Z"
},
{
"tag": "v1.0.12",
"kind": "patch",
"published_at": "2026-05-21T02:30:23Z"
},
{
"tag": "v1.0.11",
"kind": "patch",
"published_at": "2026-05-18T16:38:55Z"
},
{
"tag": "v1.0.10",
"kind": "patch",
"published_at": "2026-05-11T16:35:10Z"
},
{
"tag": "v1.0.8",
"kind": "patch",
"published_at": "2026-05-09T17:05:46Z"
},
{
"tag": "v1.0.7",
"kind": "patch",
"published_at": "2026-05-08T12:38:23Z"
},
{
"tag": "v1.0.5",
"kind": "patch",
"published_at": "2026-05-07T11:27:21Z"
},
{
"tag": "v1.0.3",
"kind": "patch",
"published_at": "2026-05-07T08:38:00Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-05-02T02:15:21Z"
},
{
"tag": "v0.8.27",
"kind": "patch",
"published_at": "2026-04-30T17:55:38Z"
},
{
"tag": "v0.8.26",
"kind": "patch",
"published_at": "2026-04-30T09:17:46Z"
},
{
"tag": "v0.8.25",
"kind": "patch",
"published_at": "2026-04-19T09:15:12Z"
},
{
"tag": "v0.8.24",
"kind": "patch",
"published_at": "2026-03-04T00:26:44Z"
},
{
"tag": "v0.8.23",
"kind": "patch",
"published_at": "2026-02-23T10:39:33Z"
},
{
"tag": "v0.8.22",
"kind": "patch",
"published_at": "2026-02-16T15:05:32Z"
},
{
"tag": "v0.8.21",
"kind": "patch",
"published_at": "2026-01-19T17:55:04Z"
},
{
"tag": "v0.8.20",
"kind": "patch",
"published_at": "2026-01-15T10:43:31Z"
},
{
"tag": "v0.8.19",
"kind": "patch",
"published_at": "2026-01-08T22:53:31Z"
},
{
"tag": "v0.8.17",
"kind": "patch",
"published_at": "2026-01-04T02:02:52Z"
},
{
"tag": "v0.8.16",
"kind": "patch",
"published_at": "2026-01-02T16:45:12Z"
},
{
"tag": "v0.8.15",
"kind": "patch",
"published_at": "2026-01-02T02:52:45Z"
},
{
"tag": "v0.8.14",
"kind": "patch",
"published_at": "2025-12-31T12:55:26Z"
},
{
"tag": "v0.8.13",
"kind": "patch",
"published_at": "2025-12-24T18:57:24Z"
},
{
"tag": "v0.8.11",
"kind": "patch",
"published_at": "2025-12-15T00:41:54Z"
},
{
"tag": "v0.8.10",
"kind": "patch",
"published_at": "2025-12-12T18:37:38Z"
},
{
"tag": "v0.8.9",
"kind": "patch",
"published_at": "2025-12-10T13:10:04Z"
},
{
"tag": "v0.8.8",
"kind": "patch",
"published_at": "2025-12-09T01:41:09Z"
},
{
"tag": "v0.8.7",
"kind": "patch",
"published_at": "2025-12-08T14:23:56Z"
},
{
"tag": "v0.8.6",
"kind": "patch",
"published_at": "2025-12-08T11:25:31Z"
},
{
"tag": "v0.8.4",
"kind": "patch",
"published_at": "2025-12-08T02:39:07Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2025-12-01T13:54:31Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2025-11-30T02:19:28Z"
},
{
"tag": "v0.8.0-rc.4",
"kind": "prerelease",
"published_at": "2025-11-30T02:05:31Z"
},
{
"tag": "v0.8.0-rc.3",
"kind": "prerelease",
"published_at": "2025-11-30T01:42:18Z"
},
{
"tag": "v0.8.0-rc.2",
"kind": "prerelease",
"published_at": "2025-11-13T00:00:45Z"
},
{
"tag": "v0.8.0-rc.1",
"kind": "prerelease",
"published_at": "2025-11-12T11:50:59Z"
},
{
"tag": "v0.7.10",
"kind": "patch",
"published_at": "2025-10-16T09:57:21Z"
},
{
"tag": "v0.7.9",
"kind": "patch",
"published_at": "2025-10-13T09:53:52Z"
},
{
"tag": "v0.7.8",
"kind": "patch",
"published_at": "2025-10-08T23:57:17Z"
},
{
"tag": "v0.7.7",
"kind": "patch",
"published_at": "2025-10-08T10:44:27Z"
},
{
"tag": "v0.7.6",
"kind": "patch",
"published_at": "2025-10-07T09:34:36Z"
},
{
"tag": "v0.7.5",
"kind": "patch",
"published_at": "2025-10-01T11:13:33Z"
},
{
"tag": "v0.7.5-rc.2",
"kind": "prerelease",
"published_at": "2025-09-30T10:02:57Z"
},
{
"tag": "v0.7.5-rc.1",
"kind": "prerelease",
"published_at": "2025-09-26T23:24:33Z"
},
{
"tag": "v0.7.4",
"kind": "patch",
"published_at": "2025-09-25T16:00:48Z"
},
{
"tag": "v0.7.3",
"kind": "patch",
"published_at": "2025-09-25T14:49:42Z"
},
{
"tag": "v0.7.2",
"kind": "patch",
"published_at": "2025-09-25T11:53:20Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2025-09-18T10:02:03Z"
},
{
"tag": "v0.7.0-rc.5",
"kind": "prerelease",
"published_at": "2025-09-18T09:45:30Z"
},
{
"tag": "v0.7.0-rc.4",
"kind": "prerelease",
"published_at": "2025-09-14T23:39:34Z"
},
{
"tag": "v0.7.0-rc.3-beta1",
"kind": "prerelease",
"published_at": "2025-09-14T22:48:29Z"
},
{
"tag": "v0.7.0-rc.3",
"kind": "prerelease",
"published_at": "2025-09-14T00:55:23Z"
},
{
"tag": "v0.7.0-rc.2",
"kind": "prerelease",
"published_at": "2025-09-13T22:43:10Z"
},
{
"tag": "v0.7.0-rc.1",
"kind": "prerelease",
"published_at": "2025-09-07T12:10:01Z"
},
{
"tag": "v0.7.0-beta17",
"kind": "prerelease",
"published_at": "2025-09-07T02:03:41Z"
},
{
"tag": "v0.7.0-beta16",
"kind": "prerelease",
"published_at": "2025-09-06T02:13:35Z"
},
{
"tag": "v0.7.0-beta15",
"kind": "prerelease",
"published_at": "2025-09-06T00:02:41Z"
},
{
"tag": "v0.7.0-beta14",
"kind": "prerelease",
"published_at": "2025-09-05T23:37:34Z"
},
{
"tag": "v0.7.0-beta12",
"kind": "prerelease",
"published_at": "2025-09-05T23:25:53Z"
},
{
"tag": "v0.7.0-beta11",
"kind": "prerelease",
"published_at": "2025-09-04T21:44:16Z"
},
{
"tag": "v0.7.0-beta10",
"kind": "prerelease",
"published_at": "2025-09-03T22:27:01Z"
},
{
"tag": "v0.7.0-beta9",
"kind": "prerelease",
"published_at": "2025-09-03T12:22:32Z"
},
{
"tag": "v0.7.0-beta8",
"kind": "prerelease",
"published_at": "2025-09-02T16:05:05Z"
},
{
"tag": "v0.7.0-beta7",
"kind": "prerelease",
"published_at": "2025-08-29T13:13:33Z"
},
{
"tag": "v0.7.0-beta6",
"kind": "prerelease",
"published_at": "2025-08-28T09:46:09Z"
},
{
"tag": "v0.7.0-beta5",
"kind": "prerelease",
"published_at": "2025-08-28T09:04:45Z"
},
{
"tag": "v0.7.0-beta3",
"kind": "prerelease",
"published_at": "2025-08-27T09:37:19Z"
},
{
"tag": "v0.7.0-beta1",
"kind": "prerelease",
"published_at": "2025-08-13T08:09:39Z"
},
{
"tag": "v0.7.0-beta4",
"kind": "prerelease",
"published_at": "2025-08-27T21:50:39Z"
},
{
"tag": "v0.7.0-beta2",
"kind": "prerelease",
"published_at": "2025-08-14T11:20:43Z"
},
{
"tag": "v0.6.2-beta10",
"kind": "prerelease",
"published_at": "2025-06-24T22:59:43Z"
},
{
"tag": "v0.6.2-beta9",
"kind": "prerelease",
"published_at": "2025-06-22T12:02:11Z"
},
{
"tag": "v0.6.2-beta8",
"kind": "prerelease",
"published_at": "2025-06-20T22:59:56Z"
},
{
"tag": "v0.6.2-beta7",
"kind": "prerelease",
"published_at": "2025-06-20T18:25:16Z"
},
{
"tag": "v0.6.2-beta5",
"kind": "prerelease",
"published_at": "2025-06-20T08:48:10Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2025-05-23T09:56:57Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2025-05-23T00:54:36Z"
},
{
"tag": "v0.5.51-beta.7",
"kind": "prerelease",
"published_at": "2025-05-22T14:08:27Z"
},
{
"tag": "v0.5.51-beta.6",
"kind": "prerelease",
"published_at": "2025-05-21T19:51:38Z"
},
{
"tag": "v0.5.51-beta.5",
"kind": "prerelease",
"published_at": "2025-05-21T09:46:40Z"
},
{
"tag": "v0.5.51-beta.4",
"kind": "prerelease",
"published_at": "2025-05-09T18:14:09Z"
},
{
"tag": "v0.5.51-beta.3",
"kind": "prerelease",
"published_at": "2025-05-07T01:35:41Z"
},
{
"tag": "v0.5.51-beta.2",
"kind": "prerelease",
"published_at": "2025-05-06T19:23:28Z"
},
{
"tag": "v0.5.51-beta.1",
"kind": "prerelease",
"published_at": "2025-05-06T18:39:50Z"
},
{
"tag": "v0.5.50",
"kind": "patch",
"published_at": "2025-04-13T23:47:58Z"
},
{
"tag": "v0.5.48",
"kind": "patch",
"published_at": "2025-04-13T23:02:34Z"
}
],
"recent_commits": [
{
"oid": "edb7174cc81446859e2967829934bff3f07e4084",
"body": "The install snippet in the README still pinned v0.7.10 and the example\nconfigs v0.8.0, so anyone following the docs installed a release far\nbehind the current v1.0.29.\n\nCo-authored-by: Markus Renschler <markus.renschler@apsensing.com>",
"is_bot": false,
"headline": "docs: pin documented plugin version to v1.0.29 (#153)",
"author_name": "au-ee",
"author_login": "au-ee",
"committed_at": "2026-07-31T09:04:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e51bd9cdbe8db232c8aa813c1e2c70d7b1e7365f",
"body": "The plugin catalog analyzer failed v1.0.28 with \"invalid handler\ntype: <nil>\" (#151). Two defects combined.\n\nThe analyzer feeds .traefik.yml testData to New() verbatim. The header\nvalues used quadruple braces on a false premise: no configuration path\ncollapses them. Template validation rejected them\n[…]\nfixes. README and CONFIGURATION.md now\ngive correct escaping guidance: plain double braces everywhere; file\nprovider users escape with a raw string. Quadruple braces do not work\nanywhere.\n\nFixes #151.",
"is_bot": false,
"headline": "fix(catalog): analyzer-valid testData and explicit New() error return",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-07-22T09:22:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f320d0a31631fd0e55dbad8ba301da99067436d3",
"body": "…llowedClaims (#150)\n\n* fix(settings): allow documented range + static header templates (#149)\n\nUpgrading past the release where NewWithContext began calling\nconfig.Validate() (546ceb9) broke `headers` configs that worked in 0.8.25:\nNew() returned a nil handler and Traefik logged the opaque \"invalid\n[…]\nsted claim stays rejected. A regression assertion that\ncoupled to the old validator's \"dangerous\" wording now checks the stable\n\"failed security validation\" wrapper (the templates are still rejected).",
"is_bot": false,
"headline": "fix(settings): repair #149 + AST-based header template validation + a…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-07-21T12:04:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "48a19e04f830e182d1fbb35079515dd2a3ffbbc4",
"body": "validateTemplateSecure matched safe functions with literal strings.Contains\n(\"{{get \"), so a space after {{ (\"{{ get\") failed the whitelist and\nConfig.Validate() rejected the config, surfacing as Traefik's opaque\n\"invalid handler type: <nil>\". Go's text/template treats {{ get and {{get\nidentically, \n[…]\nlize inner-delimiter whitespace before matching. This also closes a\nsecurity gap where a leading space let dangerous patterns (\"{{ range\",\n\"{{ call\") evade detection.\n\nAdds unit + regression coverage.",
"is_bot": false,
"headline": "fix(settings): tolerate whitespace in header template delimiters (#148)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-06-26T10:49:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "546ceb949c8c63658e9c753cbd00108eddf5a60c",
"body": "…d validation (#144)\n\n* fix(security): encrypt session cookies + fail closed on invalid config\n\nBatch 1 of security audit remediation (ranks 1, 2, 6).\n\n- session.go: derive independent HMAC + AES-256 keys via stdlib HKDF-SHA256\n and build the gorilla cookie store with both, so session cookies are n\n[…]\n the failure was recorded, so reading the counter immediately raced and flaked on slow CI runners. Poll until the failure lands (2s budget) instead. Verified 200x plain + 50x under -race/GOMAXPROCS=1.",
"is_bot": false,
"headline": "security: remediate audit findings (ranks 1–16 + 22 Lows) + yaegi loa…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-30T13:10:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f75b2f20e042ddd6b915906ff2baa41c833cb8ff",
"body": "…ase]\n\nuniversal_cache: stop the write-lock convoy / 100%-CPU spin (observed via pprof: one ServeHTTP goroutine holding c.mu.Lock for hours while 119 requests queued). The per-request populate path (updateLocalCache) PushFronted a duplicate LRU node + overwrote items[key] without removing the prior \n[…]\nrkflow-prepare.sh so the release semver is stamped into source at build time (the value cannot be resolved at runtime under Yaegi). dev/source builds keep the 0.0.0-dev sentinel and emit no telemetry.",
"is_bot": false,
"headline": "fix: resolve cache eviction lock-up and migrate telemetry [patch-rele…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-30T12:22:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cf6ed1da5559cc5ae3fdfd9b399a13dead4f23c8",
"body": "…rs) (#139)\n\nAdds optional extraAuthParams map[string]string config.\n\nExtra params are appended to the authorization request but can never\noverride plugin-managed params (client_id, state, nonce, etc.).",
"is_bot": false,
"headline": "feat: feat: add extraAuthParams (extra authorization request paramete…",
"author_name": "paiking1",
"author_login": "paiking1",
"committed_at": "2026-05-27T20:41:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f821b8829b32772337436a85a230d369dc81e489",
"body": "UniversalCache.getLocal(): when a cached token expires, the RLock fast\npath (line 385-398) previously fell through to c.mu.Lock() (write lock).\nUnder Yaegi, the write-lock holder takes 10-100ms for LRU manipulation,\nand Go's RWMutex writer-priority blocks ALL new RLock callers. A single\nexpired-toke\n[…]\n, next) — a second Load that can\nsee a different value from a concurrent writer, silently overwriting\ntheir update. Fixed to CompareAndSwap(cur, next) using the snapshot we\ncomputed the mutation from.",
"is_bot": false,
"headline": "fix: remove write-lock convoy in getLocal + fix mutateState CAS bug",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-24T23:06:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5f9c574f959abe77ca290b65b17732bab14fd8ce",
"body": "After v1.0.20 the non-RS validation chain had no production callers —\nmiddleware.ServeHTTP dispatched exclusively through isUserAuthenticatedRS.\nThe orphaned functions stayed reachable only from a handful of test\nfiles and risked silent logic drift against their RS counterparts.\n\nDeleted from produc\n[…]\nproduction, ~+25 LOC tests, +3 LOC stub.\nProduction now has a single source of truth for token validation;\nno parallel implementations to keep in sync.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "refactor: delete dead non-RS validators; tests use RS variants",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T12:04:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7c6f09fb2081ca104c4bb5cb49a3d768840f3b5b",
"body": "Adds token_validation_rs.go with requestState-aware variants of the\ntoken validation path:\n\n isUserAuthenticatedRS(rs) -> dispatches by provider\n validateStandardTokensRS(rs) -> standard path (eliminates 17 RLocks)\n validateAzureTokensRS(rs) -> Azure path (eliminates 10 RLocks)\n val\n[…]\nchanges, the RS variants need\n matching updates. This is acceptable for now; a future refactor\n could collapse them once the non-RS callers are gone.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "feat(middleware): RS-aware token validators (kill ~21 RLocks/request)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T11:38:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68e1c4319c0dd5f041cbba2e3c34c21cc0b19b5e",
"body": "Adds requeststate.go and threads a *requestState through the\nServeHTTP -> processAuthorizedRequestRS -> forwardAuthorized path.\nrs is allocated once at the top of ServeHTTP, populates SessionData\nfield snapshots under a SINGLE sd.sessionMutex.RLock, and caches the\nMetadataSnapshot. Downstream handle\n[…]\nthe token-verification path is a follow-up.\n* No semantic changes to authentication, refresh, or session\n lifecycle — only the read path is optimised.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "feat(middleware): per-request context object (requestState)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T11:22:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "17e3f8ef627bb61d2dc3ac5e382f2c883258064a",
"body": "Two related lock-free snapshot refactors addressing the remaining\npost-v1.0.16 code-review findings.\n\n1. refreshAttemptTracker: per-field atomic.Load/Store -> atomic.Value\n snapshot of *attemptState (refresh_coordinator.go).\n\n Previously each tracker held five independently-atomic fields. The\n \n[…]\nonly the\nlegacy unsafe.Pointer-based atomic primitives — no generic Pointer[T].\natomic.Value provides the same semantics via interface{} + type assert.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "fix: snapshot patterns for refresh-tracker and metadata URLs",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T10:31:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "827926bc3a845585afab0f56448509861865ef04",
"body": "Three related changes addressing post-v1.0.15 code-review findings and\nthe user's observation that we have been \"throwing maps around\" — under\nYaegi every sync.Map / atomic / mutex dispatch costs ~1-5ms of\ninterpreter overhead, so the number of dispatches per request matters\nas much as whether they \n[…]\nown), not a correctness disaster. Fix is a single atomic\n pointer swap of an immutable snapshot — same atomic.Pointer constraint\n as above. Deferred.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "fix(refresh-coordinator): trim per-request mutex/map ops",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T10:23:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "abbfdb02a71d82c45216f11b3f98d73ef25f7b2d",
"body": "JWKCache.GetJWKS previously held a sync.RWMutex.Lock() across the entire\nHTTP round-trip to the IdP's JWKS endpoint (jwk.go:93). On a cold cache\n(cold pod, JWK rotation, transient network blip) every concurrent\nrequest piled up on this single global write-lock. Under Yaegi each\nLock() acquisition co\n[…]\ns a stray yaegi-extract output file\n(github_com-lukaszraczylo-traefikoidc.go) that was accidentally\ncommitted during local yaegi compatibility testing.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "fix(jwk): replace JWKCache.mutex with singleflight pattern",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T10:05:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "72e2b682bbd15f5e082eb6e1f9fe9ae078fb9549",
"body": "The v1.0.14 fix replaced one contended sync.RWMutex (RefreshCoordinator.\nrefreshMutex) with sync.Map. Production showed the same death-spiral\nsignature recurring ~2 hours later — same shape, different mutex:\n65 goroutines stuck on a sync.(*RWMutex).Lock at one address, pod\npinned at 1000m CPU, ident\n[…]\n the 4 mutex ops of v1.0.14. Under low\ncontention this is a modest CPU bump. Under high contention it's\nan unbounded → bounded transformation. Net win.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "fix: eliminate per-request global mutexes in Yaegi hot paths",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T09:47:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ae4ccaa89d34719a5e5b10ca52d3c58041fb7686",
"body": "Under Yaegi, the RefreshCoordinator.refreshMutex was held for tens of\nmilliseconds per request because every operation inside the critical\nsection (map access, isInCooldown, recordRefreshAttempt,\nisUnderMemoryPressure, atomic ops, struct allocation) is dispatched\nthrough reflect.Value.Call with full\n[…]\nical section is no longer Yaegi-interpreted; it\ncollapses to atomic instructions on a sharded sync.Map. Refresh\ncontention disappears even under Yaegi.\n\nAll tests pass with -race; golangci-lint clean.",
"is_bot": false,
"headline": "fix(refresh-coordinator): replace global RWMutex with sync.Map",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-23T01:34:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "984fd1c08f69d78678487d0a04d5b152f02399df",
"body": "Discloses the single anonymous adoption ping sent on first plugin\ninstantiation. Points users to the upstream README section for the\ndisclosure pattern and to the local telemetry.go for the inline\nimplementation.",
"is_bot": false,
"headline": "docs: add Telemetry section linking to oss-telemetry opt-out docs",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-21T03:07:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99bdd2398687c27fec69a76c00f95829e241c650",
"body": "Adds a yaegi-safe inline telemetry helper that fires a single\nfire-and-forget ping at plugin load. Helps track adoption and version\nspread. No persistent identifiers are collected.\n\nImplementation notes:\n- inline (no external dep) so Traefik plugin loader does not need to\n resolve a new vendored mo\n[…]\nrds against amplified pings on Traefik dynamic config\n reloads (which re-instantiate the middleware)\n\nOpt out via any of:\n DO_NOT_TRACK=1\n OSS_TELEMETRY_DISABLED=1\n TRAEFIKOIDC_DISABLE_TELEMETRY=1",
"is_bot": false,
"headline": "feat: anonymous usage telemetry via inline oss-telemetry",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-21T02:20:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a548665edb18c41631ec3ea292302bc197907a75",
"body": "* docs: bearer-token auth design spec\n\n* docs: harden bearer-auth spec with security review findings\n\n* feat(bearer): opt-in M2M bearer-token authentication\n\nAdds an opt-in Authorization: Bearer <jwt> path for machine-to-machine\nclients. Replaces and supersedes the broken approach in PR #93\n(synthet\n[…]\n per-provider parameter\nnames so people don't have to dig through IdP docs.\n\nLocations:\n - docs/BEARER_AUTH.md — full section under \"Quick start\"\n - README.md — short snippet + deep link",
"is_bot": false,
"headline": "feat: opt-in M2M bearer-token authentication (supersedes #93) (#140)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-18T16:35:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8c5df82dcf01f2f7b86cb862c6a1a3a777703eca",
"body": "…) (#138)\n\nFollowup to issue #134 — two reporters returned saying that even with the\nJWKS caching fix in v1.0.7/v1.0.8, every request emitted:\n\n ERROR: TraefikOidcPlugin: UNKNOWN token verification failed:\n signature verification failed: crypto/rsa: verification error\n ERROR: TraefikOidcPlugin:\n[…]\nn case any\n path outside validateAzureTokens reaches it.\n\nAuthorization still hinges on a separately-verifiable ID token — the\nconfused-deputy guard from CWE-441 is preserved (and explicitly tested).",
"is_bot": false,
"headline": "fix(azure): treat Microsoft proprietary access tokens as opaque (#134…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-11T16:31:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa96e9dbeec8d926f6890926e7a2cb3c46614b43",
"body": "Just in case you appreciate this project, feel generous and want to sponsor my caffeine addiction.",
"is_bot": false,
"headline": "Add sponsorship",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-10T20:25:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e33bb0a4d2d0b1ae659773d5686c88ca43a8694",
"body": "revocation endpoints, joining the existing client_secret_post default.\nBoth are opt-in via the new clientAuthMethod config field. Closes #135.\n\nprivate_key_jwt (RFC 7523 §2.2 / OpenID Connect Core §9)\n========================================================\nPlugin signs a short-lived JWT with a conf\n[…]\n\n=======================\nmTLS / tls_client_auth (RFC 8705) — separate change; requires per-call\nhttp.Client with tls.Config.Certificates and conflicts with the current\npooled HTTP client architecture.",
"is_bot": false,
"headline": "feat(auth): support private_key_jwt and client_secret_basic (#137)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-09T17:02:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bfd702a44753b4ca295dfc2e1743d13bfb32cdbb",
"body": "Under yaegi (Traefik's plugin runtime) json.Marshal exposes unexported\nstruct fields with an X-prefixed name. parsedJWKS{ keys map[string]\ncrypto.PublicKey } therefore round-tripped through Redis as\n{\"Xkeys\":{\"<kid>\":{\"N\":<huge>,\"E\":65537}}} — *rsa.PublicKey.N is a\n*big.Int that marshals to a JSON n\n[…]\nads under those keys, and Redis TTL retires them.\n\nIncludes regression coverage for the Azure round-trip, the\npoisoned-stale-data scenario, and the SetLocal/GetLocal isolation\ncontract.\n\npatch-release",
"is_bot": false,
"headline": "fix(jwk): keep parsed JWKS in local cache only (#134) (#136)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-08T12:35:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68c150eba44e304be1a0b40d659598ed8d28030c",
"body": "The redis.enableTLS / redis.tlsSkipVerify settings were accepted by the\nconfig layer but silently dropped before reaching the connection pool, so\nthe plugin always dialed Redis in plaintext. This blocked TLS-only Redis\ndeployments such as AWS ElastiCache with in-transit encryption.\n\n- Add EnableTLS,\n[…]\n(added in 684a990) in README.md,\n docs/CONFIGURATION.md and docs/index.html.\n- Add the missing redis.tlsSkipVerify row to docs/index.html and clarify\n the redis.enableTLS description.\n\npatch-release",
"is_bot": false,
"headline": "fix(cache/redis): honor enableTLS for Redis backend (#133)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-07T11:24:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9cbca4c4fb4b270d7484ae1709b3cfe5871f409d",
"body": "patch-release\n\nThe refresh path in token_manager.go hardcoded the \"email\" claim when\nextracting the user identifier from a refreshed ID token, ignoring the\nconfigured userIdentifierClaim. Keycloak users without an email claim\n(using sub or another identifier) were kicked out on refresh even\nthough t\n[…]\nifier\" and\ncombinedSessionPayload field E (json:\"e\") → Ui (json:\"ui\").\n\nCompat note: existing user sessions invalidate on upgrade — every active\nuser re-authenticates once after deploying this change.",
"is_bot": false,
"headline": "fix(refresh): honor userIdentifierClaim in token refresh path (#132)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-07T08:21:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "684a990f59ca2632c2374960897487208bac7fe2",
"body": "minor-release\n\nBehaviour changes (potentially breaking for operators relying on the prior\nunauthenticated SSE bypass):\n\n* SSE (`Accept: text/event-stream`) and WebSocket upgrade requests now\n return 401 when no authenticated session is present. Previously the\n bypass forwarded unconditionally, whi\n[…]\ners; it now returns\n bool so the dispatcher can reject unauthenticated SSE/WS with 401.\n* Added tests for SSE and WS bypass covering both the auth-rejection\n path and the authenticated forward path.",
"is_bot": false,
"headline": "fix: reduce yaegi CPU footprint + require auth on SSE/WebSocket bypass",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-05-02T02:12:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1b6c8616fd3c1dfa7599b41f2018ce63c973aa96",
"body": "…e hot path (target v0.8.27) (#131)\n\n* fix(refresh): wire RefreshCoordinator into the live refresh path\n\nThe RefreshCoordinator existed but was never instantiated. The actual\nrefresh path used only session.refreshMutex, which is per-SessionData\ninstance - and SessionData is pulled from a sync.Pool p\n[…]\nrossReplicaCache: leader stores\n a successful result for peers to find\n- TestCoordinatedTokenRefresh_ErrorIsNotCached: invalid_grant must not\n poison the dedup cache - peers must retry independently",
"is_bot": false,
"headline": "fix(refresh): coalesce refresh-token grants + bound goroutines + cach…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-04-30T17:52:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4d28fa01abe035d4b8d334a101cab0781fea4028",
"body": "Hot-path JWT verification rebuilt the public key on every call:\n jwk -> ToRSAPublicKey -> x509.MarshalPKIXPublicKey -> pem.Encode\n -> verifySignature -> pem.Decode -> x509.ParsePKIXPublicKey -> verify\nUnder yaegi this pinned a CPU when many concurrent dashboard panels\npoll behind the middleware. T\n[…]\nal and metadata\n caches are unchanged (tests cover the strict-LRU contract there).\n* mocks: MockJWKCache, EnhancedMockJWKCache, mockJWKCacheForLogout,\n staticJWKCache satisfy the extended interface.",
"is_bot": false,
"headline": "perf(jwk,cache): cache parsed public keys + RLock token cache reads",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-04-30T09:14:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2d1b04c637a5324bdf45b36807298f1d18eb890c",
"body": "* Multiple fixes\n\n- refresh coordinator dedup + memory pressure wire\n- middleware sse consolidation + timer leak + claim cache\n- universal cache sync backfill + isDebug gate\n- lazy background task race\n- memory monitor stw cached + refresh() api\n\n* fix(auth): suppress OIDC redirects on non-navigatio\n[…]\ncates section\n\n* Fix the documentation.\n\n* test(redis): add oversized argument rejection test\n\n- [x] Add TestRedisConn_RejectOversizedArgumentBytes\n- [x] Import strings package\n\n* Dependencies cleanup",
"is_bot": false,
"headline": "review fixes apr 2026 (#130)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-04-19T09:12:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ccbb98b9dd8891e9f0eb4417b8ae4b4356cb6885",
"body": null,
"is_bot": false,
"headline": "fix-issue-122 (#128)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-03-04T00:23:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1362cc0dac37aac7f9d4e85348aca9cabd0ffceb",
"body": "* Add debug logging around callback URL matching in ServeHTTP\n\nThe callback URL comparison at the core of OIDC flow had zero logging,\nmaking it extremely difficult to diagnose redirect loop issues caused\nby misconfigured callbackURL (e.g., full URL vs path-only).\n\nEvery other path comparison in Serv\n[…]\nere callbackURL was set as a full URL but compared against\nreq.URL.Path which only contains the path component.\n\nCloses #3\n\n* improve-callback-url-logging: Add init-time logging for callbackURL config",
"is_bot": false,
"headline": "Improve debug logging around callback URL matching (#126)",
"author_name": "Serhii Vasyliev",
"author_login": "serhii-ciq",
"committed_at": "2026-02-23T10:36:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "249dcad1b398a10f349a907904cda988526eede3",
"body": "Move mutex unlock before calling Save() to prevent potential deadlock\nwhen Save() method needs to acquire the same mutex.\n\n🤖 Generated with [Claude Code](https://claude.ai/code)\n\nCo-authored-by: Claude <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: prevent deadlock in SessionData.Clear method (#114)",
"author_name": "Yuval Bar-On",
"author_login": "yuvii",
"committed_at": "2026-02-16T15:02:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "de4b4d72581aafc20aa56a19ca4fab1f4ab1589f",
"body": "- [x] Remove sync.Pool implementation that causes reflection panics\n- [x] Replace pool-based NewRESPWriter with direct instantiation\n- [x] Replace pool-based NewRESPReader with direct instantiation\n- [x] Convert Release() methods to no-ops for API compatibility\n- [x] Add documentation explaining sync.Pool removal for Yaegi\n- [x] Remove \"sync\" import\n\nResolves #120",
"is_bot": false,
"headline": "fix(cache): remove sync.Pool for Yaegi compatibility (#121)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-01-19T17:52:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d52f1b0180e3875913d93dd0326a36c063c628e",
"body": "- [x] Reorganize golangci-lint configuration with documented disable reasons\n- [x] Simplify errcheck and revive linter rules with targeted exclusions\n- [x] Pre-compile regex patterns in input_validation.go for performance\n- [x] Fix type assertions in memory_shard.go and resp.go with safety checks\n- \n[…]\nings.go\n- [x] Simplify metrics summary building in internal/recovery/metrics.go\n- [x] Pre-allocate slice in error_recovery.go GetDegradedServices\n- [x] Refactor context cancellation checks in redis.go",
"is_bot": false,
"headline": "feat(core): refactor linters config and improve code quality (#119)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-01-15T10:40:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "57724918fe1d443bd2bdc2409ef55b272b42f8f7",
"body": "* Fix cache serialisation\n\n* fix(cache): add integer overflow protection for serialization\n\n- [x] Add maxCacheEntrySize constant (64 MiB) to prevent memory overflow\n- [x] Validate byte slice size before adding marker byte\n- [x] Validate JSON-serialized data size before marker addition\n- [x] Add comp\n[…]\no use 3 mock servers\n- Updated SingletonTasksAcrossInstances to use mock servers array\n\nThis prevents network calls and makes tests more reliable and faster.\n\nFixes test failures in GitHub Actions CI.",
"is_bot": false,
"headline": "fix 116 (#118)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-01-08T22:50:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "775de2ada181112f136cb3a7fd225dcf3e143a6d",
"body": "* Fix cache serialisation\n\n* fix(cache): add integer overflow protection for serialization\n\n- [x] Add maxCacheEntrySize constant (64 MiB) to prevent memory overflow\n- [x] Validate byte slice size before adding marker byte\n- [x] Validate JSON-serialized data size before marker addition\n- [x] Add comprehensive overflow protection test cases",
"is_bot": false,
"headline": "Fix cache serialisation (#117)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-01-08T22:06:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7816e05c9820a29c553e1e4b0d22f7fc93366a06",
"body": "* fix(logout): handle logout requests before OIDC initialization\n\n- [x] Add debug logging to logout handler entry point\n- [x] Move logout path check before OIDC initialization to enable logout when provider unavailable\n- [x] Move excluded URL and SSE checks before initialization wait\n- [x] Add debug\n[…]\n manager with session invalidation cache support\n\nResolves #110\n\n* fixup! feat(logout): implement OIDC backchannel and front-channel logout\n\n* fixup! Merge branch 'main' into fix-issue-with-logout-url",
"is_bot": false,
"headline": "fix issue with logout url (#112)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2026-01-04T01:59:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8bf7998150653cd4bf5b6589bc67c5cdf02aedce",
"body": "…ters (#113)",
"is_bot": false,
"headline": "Fix for Hashicorp Vault - accept opaque access tokens with dot-charac…",
"author_name": "Dominik Chilla",
"author_login": "chillout2k",
"committed_at": "2026-01-02T16:42:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22c4323fcb7698425cf4d305537ab598ac2b4090",
"body": "…on (#111)\n\nCo-authored-by: muffin <MonsterMuffin@users.noreply.github.com>",
"is_bot": false,
"headline": "fix: set X-Forwarded-User header for SSE requests from existing sessi…",
"author_name": "muffn_",
"author_login": "monstermuffin",
"committed_at": "2026-01-02T02:50:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06b219d1f882588ae850d3d89ccadd33f3987d16",
"body": "…109)\n\n- [x] Add file and Redis storage backends for DCR credentials\n- [x] Implement storage abstraction with FileStore and RedisStore\n- [x] Add factory function for automatic backend selection (auto/file/redis)\n- [x] Integrate DCR credentials cache into UniversalCacheManager\n- [x] Add comprehensive\n[…]\nctory\n- [x] Update configuration schema with storage backend options\n- [x] Update documentation with multi-replica deployment guidance\n- [x] Add Redis key prefix configuration for credential isolation",
"is_bot": false,
"headline": "feat(dcr): Add Redis storage support for multi-replica deployments (#…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-31T12:52:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "413e4a1b7d8f87358311790cf6e5e55c758c2cd5",
"body": "* LRU + cache conflicts prevention.\n\n* Bugfix universalCache flooding ( issue #105 )\n\n 1. Traefik cancels the context for old plugin instances\n 2. Each plugin's Close() method is called\n 3. The CacheInterfaceWrapper.Close() was calling cache.Close() on the shared singleton caches\n 4. Each Close() triggered Clear() which logged \"Cleared all items\" at INFO level",
"is_bot": false,
"headline": "LRU + cache conflicts prevention. (#104)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-24T18:54:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "69e0d98c67fc56fd1a62dbf19af77923f70a3e25",
"body": null,
"is_bot": false,
"headline": "fixup! Add signing of the plugin on release.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-24T12:33:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d893df12b1a8e9f709126975418e135f0e9f42a",
"body": null,
"is_bot": false,
"headline": "Add signing of the plugin on release.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-15T00:38:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6efb78b7a885d5b1f23c42b994163ad1025d580f",
"body": "* Smarter approach to the cookies\n\n - Single maxCookieSize = 1400 constant with clear documentation\n - Combined cookie storage for ~40-45% size reduction\n - Backward compatible migration from legacy cookies\n\n* Tuneup the code.",
"is_bot": false,
"headline": "Smarter approach to the cookies (#103)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-12T18:35:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d0b920c4f07e538aad3fc465d70b8bd0ba1e04b6",
"body": "* Allow to use multiple realms\n\nThis change is a ressurection of PR #88 which can't be merged due to significant refactor of the codebase.\n\n* Fix the autocleanup routine to handle multiple realms correctly, update tests.\n\n* Metadata rediscovery when provider is unavailable for any reason during the start.\n\nThis one prevents the permanent 503 from the plugin when OIDC provider was for some reason unavailable during the start.",
"is_bot": false,
"headline": "multiple realms fix (#102)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-10T13:07:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c474bbafd644b950a9de66be77994f78f087d46f",
"body": "* Cleanup excessive comments.\n\n* Remove leftovers hanging around from previous refactor\n\n* Improve test coverage",
"is_bot": false,
"headline": "Cleanup [dec2025] (#101)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-09T01:38:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9126c74723a35348cd24b2269e84019cedcdf529",
"body": "…e Condition (#100)\n\n* Allow internal IPs for OIDC configuration via extra flag.\n\nAddresses issue #97\n\n* Allow for internal IPs in OIDC configuration.\n\nAddresses issue #97.\n\n* feat: Add allowPrivateIPAddresses config option for internal networks\n\nAdds a new configuration option `allowPrivateIPAddres\n[…]\n-User-Roles (still forwarded if configured)\n - Custom templated headers (still processed)\n - Skipped: X-Auth-Request-Token, X-Auth-Request-User, X-Auth-Request-Redirect\n\nFixes issues #64 and #86",
"is_bot": false,
"headline": "December 2025 Improvements - Azure AD, Internal Networks, Startup Rac…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-08T14:21:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a750c4f5b979dd27ae5b09cf449385363f4f46b2",
"body": "* Size computation for allocation may overflow\n\nPerforming calculations involving the size of potentially large strings or slices can result in an overflow (for signed integer types) or a wraparound (for unsigned types). An overflow causes the result of the calculation to become negative, while a wraparound results in a small (positive) number.",
"is_bot": false,
"headline": "Size computation for allocation may overflow (#99)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-08T11:22:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56051779eed291e7c1f30a99f24df8dc9cc40ab6",
"body": null,
"is_bot": false,
"headline": "Hotfix: goreleaser archive format.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-08T02:39:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f126d50f3569a17283c2677a8b83d3f73c96c18",
"body": null,
"is_bot": false,
"headline": "Force the v in the release tags and name.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-08T02:34:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91f0fc9ab8d0384264410d2c6b833d63cb186149",
"body": null,
"is_bot": false,
"headline": "Switch to go releaser",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-08T02:32:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "66b9ed0861c52f10fbfaddf2a85f695a55343f24",
"body": "When introspection explicitly returns that a token is inactive/revoked/expired, the plugin now properly triggers re-authentication or refresh instead of falling back to ID token validation. This fixes the functional issue where users\nweren't being redirected to re-authenticate.\nRedis change ensures that when the caller's context is cancelled (e.g., the 200ms timeout in UniversalCache.Get()), the operation aborts quickly instead of continuing with retries.",
"is_bot": false,
"headline": "Reauthentication + redis fix",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-12-01T13:47:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e64fc7f730bb31a8dc9efff2b6444337580945f0",
"body": "* Add redis support for distributed caching\n\n* Move towards the self-provided Redis connection pool and RESP protocol implementation.\nOfficial redis client library won't work with yaegi.\n\n* fixup! Move towards the self-provided Redis connection pool and RESP protocol implementation. Official redis c\n[…]\nnoreply.github.com>\n\n* fixup! Merge main into 0.8.0-redis: resolve conflicts\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Add redis support for distributed caching (#83)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-11-30T02:18:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5fcbd549558d8215f8ac89c1508dca6b75f72eb0",
"body": "* Add sharded cache and prevention of CPU spikes / locks\n\n* Add dynamic client registration with oidc provider\n\n* Fix race condition introduced during the sharded cache implementation.\n\n* Add page for traefikoidc.",
"is_bot": false,
"headline": "Add sharded cache and prevention of CPU spikes / locks (#96)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-11-30T01:41:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e70cd1907c9a95bc3277ad4dd797104362a97783",
"body": null,
"is_bot": false,
"headline": "Create CNAME",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-11-30T01:28:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e45b06c86d7b4a9927d9e89a805d0e7ba2c7b991",
"body": null,
"is_bot": false,
"headline": "Fix markdown issues.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-17T13:40:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae59a5e88aab27276945dc9a1b07c13adeba3983",
"body": "* Add ability to disable replay protection. - This is useful for runs with multiple traefik replicas to avoid false positives and tokens re-creation.\n* Enhance the CI/CD pipelines\n* Increase test coverage.\n* Update vendored dependencies.\n* Update behaviour on forceHTTPS as per issue #82",
"is_bot": false,
"headline": "0.7.10 (#80)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-16T09:56:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "79e9b164f99e0d34673928845a3a95441d0ede01",
"body": "* Speed improvements.\n\nAfter introduction of introspection the plugin became significantly slower.\nThis commit introduces several optimizations to bring the speed back up.\n\n* Add relevant documentation and tests.",
"is_bot": false,
"headline": "release 0.7.9 (#78)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-13T09:43:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93888e56d1bdb173d7a6641f38e9327cc3141c7d",
"body": null,
"is_bot": false,
"headline": "fixup! Multiple issues addressed (#76)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-08T23:56:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eff9bd7bd2c472c4588f2bca920871282f1b029f",
"body": "- Issue #74\n- Issue #14",
"is_bot": false,
"headline": "Multiple issues addressed (#76)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-08T23:44:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bde1db1c3b04f1bdc4ba5b5cc40b85975dc04eb7",
"body": "* Automatic discovery of the scopes.\n\nIssue #61 raised very valid concerns about users configuring scopes that are not supported by the provider.\nThis change introduces automatic discovery of supported scopes by fetching the provider's discovery document and filtering out unsupported scopes.\n\nBefore\n[…]\nported\nAutomatically filters to: [\"openid\", \"profile\", \"email\"]\nAuthentication: ✅ SUCCEEDS\n\n* Resolves issue #74 by enabling user to specify expected audience in the configuration.\n\n* Fix flaky tests.",
"is_bot": false,
"headline": "traefik plugin 0.7.7 (#73)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-08T10:44:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "79d34ea4c99d39699ba0cf1096a18a84f88d8ca5",
"body": null,
"is_bot": false,
"headline": "Fix recursion in token resilience logic (#72)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-07T09:34:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3f23cb99b09d75ee81b97df9ca693da994564d4",
"body": "* Resolve issue with opaque tokens not being parsed correctly\n\n* Increase test coverage\n\n* Further improvements to test coverage and code quality\n\n* Add new providers.\n\n* fixup! Add new providers.\n\n* Cleanup.\n\n* fixup! Cleanup.\n\n* fixup! fixup! Cleanup.\n\n* fixup! fixup! fixup! Cleanup.\n\n* fixup! fixup! fixup! fixup! Cleanup.\n\n* Memory management optimisation\n\n24 bytes per Put < 256-4096 bytes per buffer allocation avoided (10-170x difference)\n\n* Pooling cleanup.",
"is_bot": false,
"headline": "Release 0.7.5 (#70)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-10-01T11:13:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bbc6a16088bb13355624b6b50e5d849083a9899",
"body": null,
"is_bot": false,
"headline": "Resolve issue with opaque tokens not being parsed correctly (#69)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-09-25T16:00:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b07247f674300412b900026d95ba6a2856a3d718",
"body": null,
"is_bot": false,
"headline": "fixup! release 0.7.2 (#66) (#68)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-09-25T14:49:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e4142a7fbed7fe986db8c6d8def52f3bbaa288c",
"body": "* Remove trailing / from metadata provider.\n\n* Resolves issue #67\n - Before: 100 concurrent requests → 300+ refresh attempts → OOM\n - After: 100 concurrent requests → 1 refresh attempt → Stable memory\n\nAdded following changes:\n - Introduced a refresh coordinator to manage concurrent refresh requests\n - Implemented a test to simulate high concurrency and verify memory stability\n\n* Issue #67 fixed.",
"is_bot": false,
"headline": "release 0.7.2 (#66)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-09-25T11:52:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b49e133da1bbfed78c8d77dbfed40e33122f772",
"body": "* Fix bug affecting Azure OIDC authentication ( and most likely others )\n\n* Fixes issue #51\n\n* Ensure that appended roles are unique. Update the documentation.\n\n* Improvements targetting possible memory usage spikes.\n\n* Additional fixes and cleanup\n\n* Refactoring code to fix the issues identified by\n[…]\nun with further optimisations.\n\n* Pre-release cleanup.\n\n* Enhance test coverage.\n\n* fixup! Enhance test coverage.\n\n* fixup! fixup! Enhance test coverage.\n\n* fixup! fixup! fixup! Enhance test coverage.",
"is_bot": false,
"headline": "Complete rebuild of the plugin",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-09-18T10:01:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "784b16173209459ba017eb4911e5de7620b2307f",
"body": "* Enhance session management by adding support for chunked id token in main session\n\n* Add test for large ID token chunking in session management",
"is_bot": false,
"headline": "Fix for cookie length (#58)",
"author_name": "Arul",
"author_login": "arulrajnet",
"committed_at": "2025-07-22T08:30:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efa0cd708b1d69cbd6406006a6e1280c70351cca",
"body": null,
"is_bot": false,
"headline": "Fixes issue #50",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-26T01:48:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99881f58379cfcfe392d5f1a1cd4e5a5e8a101c7",
"body": "- Unbounded Replay Cache: Now bounded to 10,000 entries with automatic cleanup\n- Session Pool Leaks: Proper object lifecycle prevents accumulation\n- HTTP Client Leaks: Reusable clients eliminate connection overhead\n- Goroutine Leaks: Tracked lifecycle with graceful shutdown",
"is_bot": false,
"headline": "Multiple fixes",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-23T09:55:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82a640cc3bbc5e0b7b28c878daafda15a01d922a",
"body": "Cryptographic:\nRSA Algorithm Support: RS256, RS384, RS512 (PKCS1v15) + PS256, PS384, PS512 (PSS)\nElliptic Curve Support: ES256 (P-256), ES384 (P-384), ES512 (P-521)\nSecurity-First Approach: Proper rejection of HS256/HS384/HS512 and \"none\" algorithms\nAlgorithm Confusion Protection: Prevents downgrade\n[…]\nLow latency: P95 < 1ms, P99 < 5ms\nEfficient caching: 95%+ hit ratio\nOptimized resource usage with automatic cleanup\nPerfect metrics collection with detailed monitoring\nThread-safe performance tracking",
"is_bot": false,
"headline": "Large scale refactoring for the v0.6",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-23T00:52:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "24d8dc38e88acb1d59400b310701f61f8d4523c4",
"body": null,
"is_bot": false,
"headline": "Add fixes and tests for the security related edge cases.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-22T14:06:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "248ca018e23379664c3d5cc767fe6de79d0b8ad9",
"body": null,
"is_bot": false,
"headline": "Add user email filtering logic.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-21T09:43:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "003a3686a092eba8b2e3a85b6c38646ece11ec87",
"body": null,
"is_bot": false,
"headline": "Improve the memory usage.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-21T09:23:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da70e69ad1e45cb94cf3b5dade67d6dbeff0af18",
"body": null,
"is_bot": false,
"headline": "Memleak fixes.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-09T18:05:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81000a824d4095e6e788345bc28ab39adf476fe2",
"body": null,
"is_bot": false,
"headline": "Fix dirty session handling.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-07T01:33:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83693d2893e1a96986dbd360bf113e6039b89f22",
"body": null,
"is_bot": false,
"headline": "General improvements and tests related fixes.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-07T01:03:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d88ef61c5dbb54b59b6faeef7c3f5e07c71b42cf",
"body": null,
"is_bot": false,
"headline": "Fix the redirection loop.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-06T20:30:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "075476792f9db4d63d2971915f911796cd326191",
"body": null,
"is_bot": false,
"headline": "Fix: Wrong IdToken passed when AccessToken was configured",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-06T19:21:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25832667382e5415ea40d0579683392243024c7f",
"body": null,
"is_bot": false,
"headline": "fixup! fixup! Fix the issue with Google OAuth invalid scopes",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-06T17:56:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "996b25ebaf7fa417a49a80f7f6de040ad302abfe",
"body": null,
"is_bot": false,
"headline": "fixup! Fix the issue with Google OAuth invalid scopes",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-06T12:06:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75b5904099e0d52567e3e1a5d0d090fef277cfb4",
"body": null,
"is_bot": false,
"headline": "Fix the issue with Google OAuth invalid scopes",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-05-06T10:50:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8953339647d18438699d3c99bb0fd767b20314b",
"body": null,
"is_bot": false,
"headline": "Add templated headers sent to the downstream service. (#40)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-13T23:45:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "983585e96e9170aea37a35bec3bdeb42e454e1b0",
"body": null,
"is_bot": false,
"headline": "Add documentation for the google provider session timeouts. (#39)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-13T23:00:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a6e37f7fc11ddea1e7dad97ba1c7e341dd86781",
"body": null,
"is_bot": false,
"headline": "Create LICENSE",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-10T00:39:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd7eaf6dff66656b04ccfbe9862a9bdd7e588fba",
"body": null,
"is_bot": false,
"headline": "Bugfix: Refresh token not obtained when access token is expired.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-05T17:28:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3df19e6d9081d3a07e3c27905d5ed23eeacb9994",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-05T13:56:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1910cd6000fe52194ad816002dad9bda167138e0",
"body": null,
"is_bot": false,
"headline": "Update documentation to the higher standards.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-05T10:31:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "46c2f98a15066cd24078287dcf23e335f539b028",
"body": null,
"is_bot": false,
"headline": "Optimize the code, find edge cases, polish the bugs out.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-05T10:15:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e8634bfc0631a9a48b52b32a9eab19f4d636be6",
"body": null,
"is_bot": false,
"headline": "Sort out the text/event-stream issue.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-04T18:06:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23e019092a7236afa4eea393c08eadb41f73ccac",
"body": "* Improve refresh token handling in the background.\n\nResolves issue when user opens the website, allows the access token to expire, but continues browsing.\nThe background requests are failing with CORS errors to OIDC provider.\n\n* fixup! Improve refresh token handling in the background.\n\n* Abstract the token blacklisting.",
"is_bot": false,
"headline": "Multiple improvements for April 2025",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-04-04T17:42:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "43224071291661f8f9d23c156b9c779c7eebdf73",
"body": "* Add PKCE support.\n* Add option to toggle PKCE checks feature.\n* GoFMT",
"is_bot": false,
"headline": "Add support for PKCE (#31)",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-03-18T01:09:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ce281512385b5c30b21ab1dd31fcaf4f0617686",
"body": null,
"is_bot": false,
"headline": "Update the documentation.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-25T14:02:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d204113eab0f09eb16b17f525494027e259301c",
"body": "…overage.",
"is_bot": false,
"headline": "Cleanup the codebase, DRY and abstract functions, increase the test c…",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-25T12:53:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c721913cbe8e12746784676fea70441186ec9f08",
"body": null,
"is_bot": false,
"headline": "Increase tests coverage.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-24T12:25:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f8b7f7ab1d39393504f0acd90f97d94b701392f",
"body": null,
"is_bot": false,
"headline": "Abstract the cleanup logic and add helper for cache valid.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-24T12:02:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2743b0e024336ecef067ae1ec482e86537377624",
"body": null,
"is_bot": false,
"headline": "Ensure cleanups actually happen.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-24T00:19:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6fc36937bd884deb885b456d48be02695c6ecda",
"body": null,
"is_bot": false,
"headline": "Clear per-request reference to stop leaking contexts.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-24T00:04:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df051e0cfbfebcb255760f56750d55eaaba23e81",
"body": null,
"is_bot": false,
"headline": "Improve expiration logic.",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-19T20:33:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d5ce8ae5e365dea513b4da66aff06957a64bef4",
"body": null,
"is_bot": false,
"headline": "Additional tests for the blacklists",
"author_name": "Lukasz Raczylo",
"author_login": "lukaszraczylo",
"committed_at": "2025-02-19T12:08:37Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 100,
"commits_last_year": 67,
"latest_release_at": "2026-07-22T09:33:59Z",
"latest_release_tag": "v1.0.29",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 26,
"days_since_latest_release": 10,
"mean_days_between_releases": 6.7
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 57,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/lukaszraczylo/traefikoidc",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/lukaszraczylo/traefikoidc",
"is_deprecated": false,
"latest_version": "v1.0.29",
"repository_url": "https://github.com/lukaszraczylo/traefikoidc",
"versions_count": 182,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-22T09:33:54Z",
"latest_version_yanked": null,
"days_since_latest_publish": 10
}
]
},
"popularity": {
"forks": 28,
"stars": 205,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2024-08-15",
"count": 1
},
{
"date": "2024-12-12",
"count": 1
},
{
"date": "2025-03-24",
"count": 1
},
{
"date": "2025-04-10",
"count": 1
},
{
"date": "2025-04-20",
"count": 1
},
{
"date": "2025-04-30",
"count": 1
},
{
"date": "2025-05-16",
"count": 1
},
{
"date": "2025-06-01",
"count": 1
},
{
"date": "2025-10-29",
"count": 1
},
{
"date": "2025-11-17",
"count": 1
},
{
"date": "2025-12-02",
"count": 1
},
{
"date": "2025-12-19",
"count": 2
},
{
"date": "2026-01-01",
"count": 2
},
{
"date": "2026-01-02",
"count": 1
},
{
"date": "2026-01-05",
"count": 1
},
{
"date": "2026-01-15",
"count": 1
},
{
"date": "2026-01-27",
"count": 1
},
{
"date": "2026-02-21",
"count": 1
},
{
"date": "2026-02-22",
"count": 1
},
{
"date": "2026-03-03",
"count": 1
},
{
"date": "2026-03-13",
"count": 1
},
{
"date": "2026-04-18",
"count": 1
},
{
"date": "2026-05-18",
"count": 1
},
{
"date": "2026-07-25",
"count": 1
},
{
"date": "2026-07-31",
"count": 1
}
],
"complete": true,
"collected": 27,
"total_forks": 28
},
"star_history": null,
"open_issues_and_prs": 6
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"vendor/github.com/alicebob/miniredis/v2/Makefile",
"vendor/github.com/alicebob/miniredis/v2/fpconv/Makefile",
"vendor/github.com/alicebob/miniredis/v2/proto/Makefile",
"vendor/github.com/alicebob/miniredis/v2/server/Makefile",
"vendor/github.com/gorilla/securecookie/Makefile",
"vendor/github.com/gorilla/sessions/Makefile",
"vendor/github.com/redis/go-redis/v9/Makefile",
"vendor/github.com/stretchr/objx/Taskfile.yml",
"vendor/github.com/yuin/gopher-lua/Makefile",
"vendor/github.com/yuin/gopher-lua/parse/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 159878,
"source_files_sampled": 238,
"oversized_source_files": 3,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 14,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/alicebob/miniredis/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.35.0"
},
{
"name": "github.com/gorilla/sessions",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.3.0"
},
{
"name": "github.com/lukaszraczylo/oss-telemetry",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.3"
},
{
"name": "github.com/redis/go-redis/v9",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v9.17.2"
},
{
"name": "github.com/stretchr/testify",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.0"
},
{
"name": "golang.org/x/time",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.14.0"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/alicebob/miniredis/v2",
"direct": true,
"version": "v2.35.0",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/sessions",
"direct": true,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "github.com/lukaszraczylo/oss-telemetry",
"direct": true,
"version": "v0.2.3",
"ecosystem": "go"
},
{
"name": "github.com/redis/go-redis/v9",
"direct": true,
"version": "v9.17.2",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": true,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/time",
"direct": true,
"version": "v0.14.0",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": true,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/davecgh/go-spew",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/dgryski/go-rendezvous",
"direct": false,
"version": "v0.0.0-20200823014737-9f7001d12a5f",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/securecookie",
"direct": false,
"version": "v1.1.2",
"ecosystem": "go"
},
{
"name": "github.com/pmezard/go-difflib",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/objx",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "github.com/yuin/gopher-lua",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 14,
"direct_count": 7,
"indirect_count": 7
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 55,
"open_issues": 4,
"closed_ratio": 0.955,
"closed_issues": 84,
"closed_unmerged_prs": 8
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "lukaszraczylo",
"commits": 195,
"avatar_url": "https://avatars.githubusercontent.com/u/2182556?v=4"
},
{
"type": "User",
"login": "arulrajnet",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/834529?v=4"
},
{
"type": "User",
"login": "chillout2k",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/43314918?v=4"
},
{
"type": "User",
"login": "gjirm",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/32864045?v=4"
},
{
"type": "User",
"login": "serhii-ciq",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/183697801?v=4"
},
{
"type": "User",
"login": "yuvii",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/5923462?v=4"
},
{
"type": "User",
"login": "au-ee",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/3428439?v=4"
},
{
"type": "User",
"login": "monstermuffin",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/9695227?v=4"
},
{
"type": "User",
"login": "paiking1",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/205046360?v=4"
}
],
"contributors_sampled": 9,
"top_contributor_share": 0.961
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"pr.yaml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 8,
"reason": "9 out of 11 merged PRs checked by a CI test -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 2/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "25 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "edb7174cc81446859e2967829934bff3f07e4084",
"ran_at": "2026-08-01T21:37:47Z",
"aggregate_score": 5.4,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-31T09:05:41Z",
"oldest_open_prs": [
{
"number": 141,
"created_at": "2026-05-19T15:11:22Z",
"last_comment_at": "2026-05-19T15:46:49Z",
"last_comment_author": "github-actions"
},
{
"number": 143,
"created_at": "2026-05-27T20:43:31Z",
"last_comment_at": "2026-05-27T20:46:07Z",
"last_comment_author": "github-actions"
}
],
"last_merged_pr_at": "2026-07-31T09:04:48Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 122,
"created_at": "2026-01-27T10:52:48Z",
"last_comment_at": "2026-05-27T20:43:50Z",
"last_comment_author": "lukaszraczylo"
},
{
"number": 145,
"created_at": "2026-06-05T08:57:02Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 147,
"created_at": "2026-06-17T13:49:01Z",
"last_comment_at": "2026-06-18T08:00:16Z",
"last_comment_author": "exptom"
},
{
"number": 152,
"created_at": "2026-07-22T21:07:58Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/lukaszraczylo/traefikoidc",
"host": "github.com",
"name": "traefikoidc",
"owner": "lukaszraczylo"
},
"metrics": {
"overall": {
"key": "overall",
"band": "excellent",
"name": "Overall health",
"note": "The weighted overall 71 is calibrated to 84 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 71,
"calibrated": 84,
"calibration": "2026-08-02"
}
}
],
"value": 84,
"inputs": {
"security": 63,
"vitality": 88,
"community": 53,
"governance": 62,
"calibration": "2026-08-02",
"engineering": 86,
"ai_readiness": 64,
"weighted_overall_raw": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 88,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"commits_last_year": 67,
"human_commit_share": 1,
"days_since_last_push": 1,
"active_weeks_last_year": 26
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "26/52 weeks with commits",
"points": 18,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 26
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "67 commits in the last year",
"points": 16.5,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 67
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "25 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 100,
"latest_release_tag": "v1.0.29",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 6.7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "100 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 100
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~6.7 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 6.7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 2,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 2 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 2
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 53,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "weak",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"forks": 28,
"stars": 205,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "205 stars",
"points": 37.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 205
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "28 forks",
"points": 11.9,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 28
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 9,
"top_contributor_share": 0.961
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 96% of commits",
"points": 0.9,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 96
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "9 contributors",
"points": 12.2,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 9
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 76,
"inputs": {
"merged_prs": 55,
"open_issues": 4,
"closed_issues": 84,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.955,
"closed_unmerged_prs": 8,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "96% of issues closed",
"points": 40.1,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 96
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "55/63 decided PRs merged",
"points": 26.2,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 55,
"decided": 63
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 2/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 61,
"inputs": {
"followers": 79,
"owner_type": "User",
"is_verified": null,
"owner_login": "lukaszraczylo",
"public_repos": 195,
"account_age_days": 5094
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "79 followers of lukaszraczylo",
"points": 13.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 79,
"login": "lukaszraczylo"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "195 public repos, account ~13 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 195
}
},
{
"code": "account_age_years",
"params": {
"years": 13
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/lukaszraczylo/traefikoidc"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 10
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 10 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 10
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "182 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 182
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "excellent",
"name": "Engineering Quality",
"value": 86,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 86,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "9 out of 11 merged PRs checked by a CI test -- score normalized to 8",
"points": 16,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"topics": [
"traefik-plugin",
"traefik-plugin-catalog",
"traefik-auth0",
"traefik-oidc"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "4 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 4
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 63,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 54,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 5.4
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "9 out of 11 merged PRs checked by a CI test -- score normalized to 8",
"points": 2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 2/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "25 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "exceptional",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 14 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 14
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 14,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 14,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 8
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 64,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "weak",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 36,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.67,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "67 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 35.7,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 67,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile",
"vendor/github.com/alicebob/miniredis/v2/Makefile",
"vendor/github.com/alicebob/miniredis/v2/fpconv/Makefile",
"vendor/github.com/alicebob/miniredis/v2/proto/Makefile",
"vendor/github.com/alicebob/miniredis/v2/server/Makefile",
"vendor/github.com/gorilla/securecookie/Makefile",
"vendor/github.com/gorilla/sessions/Makefile",
"vendor/github.com/redis/go-redis/v9/Makefile",
"vendor/github.com/stretchr/objx/Taskfile.yml",
"vendor/github.com/yuin/gopher-lua/Makefile",
"vendor/github.com/yuin/gopher-lua/parse/Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, vendor/github.com/alicebob/miniredis/v2/Makefile, vendor/github.com/alicebob/miniredis/v2/fpconv/Makefile, vendor/github.com/alicebob/miniredis/v2/proto/Makefile, vendor/github.com/alicebob/miniredis/v2/server/Makefile, vendor/github.com/gorilla/securecookie/Makefile, vendor/github.com/gorilla/sessions/Makefile, vendor/github.com/redis/go-redis/v9/Makefile, vendor/github.com/stretchr/objx/Taskfile.yml, vendor/github.com/yuin/gopher-lua/Makefile, vendor/github.com/yuin/gopher-lua/parse/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, vendor/github.com/alicebob/miniredis/v2/Makefile, vendor/github.com/alicebob/miniredis/v2/fpconv/Makefile, vendor/github.com/alicebob/miniredis/v2/proto/Makefile, vendor/github.com/alicebob/miniredis/v2/server/Makefile, vendor/github.com/gorilla/securecookie/Makefile, vendor/github.com/gorilla/sessions/Makefile, vendor/github.com/redis/go-redis/v9/Makefile, vendor/github.com/stretchr/objx/Taskfile.yml, vendor/github.com/yuin/gopher-lua/Makefile, vendor/github.com/yuin/gopher-lua/parse/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "dependency automation configured, none observed in the sampled commits",
"points": 5,
"status": "partial",
"details": [
{
"code": "dependency_bot_config_only",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "exceptional",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 159878,
"source_files_sampled": 238,
"oversized_source_files": 3
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "3/238 source files over 60KB",
"points": 54.3,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 238,
"oversized": 3
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "weak",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"labels": [
"library"
],
"scores": {
"plugin": 2,
"library": 6
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:go",
"weight": 6
},
{
"tier": "description",
"label": "plugin",
"source": "description:plugin",
"weight": 2
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": false,
"consumed_by_code": true
},
"metrics_version": "2.3.1"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-08-01T21:37:58.506602Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/lukaszraczylo/traefikoidc.svg",
"full_name": "lukaszraczylo/traefikoidc",
"license_state": "standard",
"license_spdx": "MIT"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit lukaszraczylo/traefikoidc teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v2.3.1, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
