Öffentliches RegisterMittel
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-27 01:33 UTC
michaelpipkin / dependabot-agent
michaelpipkin/dependabot-agent erreicht einen Gesundheitsindex von 52 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Vitality (74/100) ab, am schwächsten bei Community & Adoption (32/100). Zuletzt vor 6 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
52
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
52
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
Michael PipkinPersönliches Konto
2 Follower10 öffentliche Reposseit Okt. 2013isolved
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Paket-Ökosysteme
| Registry | Paket | Version | Downloads / Monat | Versionen | Zuletzt veröffentlicht | Tags |
|---|---|---|---|---|---|---|
| npm | dependabot-agent | 1.0.2 | 2.659 | 20 | vor 6 Tagen | dependabotoverridesnpmpnpmsecurityvulnerabilitiescli |
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
74
Entwicklungsaktivität
56Mittel
Wie die Bewertung erfolgt
| 36/36 | Push-Aktualität — letzter Push vor 6 Tagen |
| 2.8/36 | Commit-Rhythmus — 4/52 Wochen mit Commits |
| 17.5/18 | Commit-Volumen — 87 Commits im letzten Jahr |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Verwendete Eingangsdaten
| commits_last_year | 87 |
| human_commit_share | 1 |
| days_since_last_push | 6 |
| active_weeks_last_year | 4 |
Release-Disziplin
100Exzellent
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 15 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 6 Tagen |
| 27/27 | Release-Rhythmus — ein Release etwa alle 0,4 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — keine Daten |
Verwendete Eingangsdaten
| releases_count | 15 |
| latest_release_tag | v1.0.2 |
| releases_from_tags | nein |
| days_since_latest_release | 6 |
| mean_days_between_releases | 0,4 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
32
Popularität & Verbreitung
1Kritisch
Wie die Bewertung erfolgt
| 0/60 | Stars — 1 Stars |
| 0/25 | Forks — 0 Forks |
| 0/15 | Watcher — 0 Watcher |
Verwendete Eingangsdaten
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
50Mittel
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (MIT) |
| 0/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | nein |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Wie die Bewertung erfolgt
| 45.7/80 | Downloads pro Monat — 2.659 Downloads/Monat über npm |
| 0/20 | Abhängige in der Registry — von diesem Ökosystem nicht ausgewiesen |
Verwendete Eingangsdaten
| packages | dependabot-agent |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 2.659 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Abhängige in der Registry. Die verbleibenden Gewichte wurden renormalisiert.
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
55
Maintainer-Resilienz (Bus-Faktor)
13Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 100 % der Commits |
| 1.4/13.5 | Breite der Beitragenden — 1 Beitragende |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Reaktionsfähigkeit bei Issues & PRs
85Exzellent
Wie die Bewertung erfolgt
| 46.8/46.8 | Issue-Lösungsquote — 100 % der Issues geschlossen |
| 38.2/38.3 | PR-Annahme — 27/27 entschiedene PRs gemergt |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/15 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 27 |
| open_issues | 0 |
| closed_issues | 4 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 0 |
Eigentümerschaft & Trägerschaft
41Gefährdet
Wie die Bewertung erfolgt
| 10/30 | Organisatorische Trägerschaft — persönliches (Nutzer-)Konto |
| 0/20 | Verifizierte Domain — für Nutzerkonten nicht anwendbar |
| 3.4/25 | Reichweite des Inhabers — 2 Follower von michaelpipkin |
| 19.6/25 | Kontohistorie — 10 öffentliche Repos, Kontoalter ca. 12 Jahre |
Verwendete Eingangsdaten
| followers | 2 |
| owner_type | User |
| is_verified | — |
| owner_login | michaelpipkin |
| public_repos | 10 |
| account_age_days | 4.672 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Verifizierte Domain. Die verbleibenden Gewichte wurden renormalisiert.
Paketpflege
100Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 1 Paket(e) auf npm |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 6 Tagen |
| 20/20 | Versionshistorie — 20 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | dependabot-agent |
| ecosystems | npm |
| any_deprecated | nein |
| min_days_since_publish | 6 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
47
Engineering-Praktiken
52Mittel
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 2 Workflow(s) |
| 24/24 | Tests vorhanden |
| 0/16 | Linter-Konfiguration |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 4/20 | OpenSSF Scorecard: CI-Tests — 3 out of 13 merged PRs checked by a CI test -- score normalized to 2 |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | ja |
| has_editorconfig | nein |
| has_linter_config | nein |
| has_precommit_config | nein |
Dokumentation
40Gefährdet
Wie die Bewertung erfolgt
| 30/30 | README |
| 0/25 | Dokumentationsverzeichnis |
| 0/15 | Dokumentations-/Homepage-Site |
| 0/10 | Repository-Beschreibung |
| 0/10 | Topics |
| 10/10 | Wiki |
Verwendete Eingangsdaten
| topics | — |
| has_wiki | ja |
| homepage | — |
| has_readme | ja |
| has_docs_dir | nein |
| has_description | nein |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
49
Sicherheitslage
36Gefährdet
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 0.5/2.5 | CI-Tests — 3 out of 13 merged PRs checked by a CI test -- score normalized to 2 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/15 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — keine Daten |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 3,6 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): signed_releases. Die verbleibenden Gewichte wurden renormalisiert.
Abhängigkeits-Advisories
100Exzellent
Wie die Bewertung erfolgt
| 35/35 | Direkte Abhängigkeiten ohne bekannte Advisories — keine direkte Abhängigkeit trägt ein bekanntes Advisory |
| 25/25 | Indirekte Abhängigkeiten ohne bekannte Advisories — keine indirekte Abhängigkeit trägt ein bekanntes Advisory |
| 0/40 | Keine offenen Advisories — kein Advisory trägt ein Veröffentlichungsdatum |
Verwendete Eingangsdaten
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 2 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Keine offenen Advisories. Die verbleibenden Gewichte wurden renormalisiert. Abgeglichen wurde die Laufzeit-Abhängigkeitshülle von npm:dependabot-agent@1.0.2 — das, was die Installation des veröffentlichten Pakets nach sich zieht — mit 2 Paketen. Erreichbarkeit wird nicht analysiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
57
AI-Agentenkontext & Leitlinien
40Gefährdet
Wie die Bewertung erfolgt
| 0/45 | Agentenanweisungen — keine CLAUDE.md / AGENTS.md / Editor-Regeln |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 40/40 | Lesbare Commit-Historie — 70 von 87 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 0,805 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Wie die Bewertung erfolgt
| 0/18 | Bootstrap mit einem Befehl |
| 22/22 | Automatisierte Tests |
| 0/11 | Lint-/Format-Konfiguration |
| 11/11 | Statische Typprüfung — tsconfig.json |
| 10/10 | Reproduzierbare Umgebung — lockfile |
| 10/10 | Belegte Agentenpraxis — 44 der letzten 87 Commits von Agenten verfasst oder ihnen zugeschrieben |
| 0/8 | Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | pnpm-lock.yaml |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | — |
| has_devcontainer | nein |
| has_linter_config | nein |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0,506 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
100Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — TypeScript (statisch typisiert) |
| 55/55 | Handhabbare Dateigrößen — 0/25 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | TypeScript |
| largest_source_bytes | 59.036 |
| source_files_sampled | 25 |
| oversized_source_files | 0 |
Eckdaten
1GitHub-Sterne
1Mitwirkende
87Commits, letzte 12 Monate
6Tage seit letztem Push
15Releases
1Bus-Faktor
0offene Issues
npmPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Weitere Details
OpenSSF Scorecard 3.6 / 10
3.6Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 2 | CI-Tests | 3 out of 13 merged PRs checked by a CI test -- score normalized to 2 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/15 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| k. A. | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
Direkte Abhängigkeiten 1
| Registry | Paket | Versionsvorgabe | Manifest |
|---|---|---|---|
| npm | js-yaml | ^4.1.0 | package.json |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Abhängigkeits-Advisories 0
Die Installation von npm:dependabot-agent@1.0.2 zieht 2 Pakete nach sich, direkt und transitiv: 0 tragen bekannte Advisories, davon 0 direkte Abhängigkeiten.
Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 347,
"has_wiki": true,
"homepage": null,
"languages": {
"JavaScript": 1679,
"TypeScript": 220459
},
"pushed_at": "2026-07-20T14:57:09Z",
"created_at": "2026-06-22T01:52:03Z",
"owner_type": "User",
"updated_at": "2026-07-20T15:00:02Z",
"description": null,
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "pipsplit.com",
"name": "Michael Pipkin",
"type": "User",
"login": "michaelpipkin",
"company": "isolved",
"location": "Maryland/D.C.",
"followers": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/5658291?v=4",
"created_at": "2013-10-10T18:15:49Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 4672
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2026-07-20T14:57:09Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-07-17T00:31:50Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-07-17T00:04:50Z"
},
{
"tag": "v0.1.16",
"kind": "patch",
"published_at": "2026-07-16T22:20:15Z"
},
{
"tag": "v0.1.15",
"kind": "patch",
"published_at": "2026-07-16T21:42:47Z"
},
{
"tag": "v0.1.14",
"kind": "patch",
"published_at": "2026-07-16T21:18:06Z"
},
{
"tag": "v0.1.13",
"kind": "patch",
"published_at": "2026-07-16T19:27:30Z"
},
{
"tag": "v0.1.12",
"kind": "patch",
"published_at": "2026-07-16T18:33:23Z"
},
{
"tag": "v0.1.11",
"kind": "patch",
"published_at": "2026-07-16T18:23:24Z"
},
{
"tag": "v0.1.10",
"kind": "patch",
"published_at": "2026-07-16T16:21:56Z"
},
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-07-16T04:31:58Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-07-15T20:42:08Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-07-15T17:42:48Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-07-15T15:13:47Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-07-15T14:08:45Z"
}
],
"recent_commits": [
{
"oid": "437b62155f885282555871ecf3f3c93cfe8aee1b",
"body": null,
"is_bot": false,
"headline": "Add update exclusion strat to README",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-20T14:56:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "661f5ef083495e273a669b19eccfaa8d846fe0e3",
"body": "Release 1.0.1 — correct fine-grained PAT permission docs",
"is_bot": false,
"headline": "Merge pull request #31 from michaelpipkin/fix-token-permission-docs",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-17T00:31:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec24142cb6a51aa84f064e1b2d7fe3bebfa2b624",
"body": "The README's Requirements and Options sections said the token needs the\n`security_events` permission. That's correct for a CLASSIC PAT, but a\nFINE-GRAINED PAT needs the \"Dependabot alerts\" repository permission (Read)\ninstead — following the old wording with a fine-grained token 403s. Fixed\nin Requi\n[…]\nomment. The\nCI-integration note already had it right.\n\nDocs only; bumps version to 1.0.1 so the corrected README publishes to npm.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Release 1.0.1 — correct fine-grained PAT permission docs",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-17T00:29:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "48a455c065042b90444ec989e41ff7ef29569fa3",
"body": "Release 1.0.0",
"is_bot": false,
"headline": "Merge pull request #30 from michaelpipkin/release-1.0.0",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-17T00:04:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "367bdd154a96d873b83180ed0bdaae5ae73319cf",
"body": "Pre-1.0 README audit against the code found one real behavior/doc mismatch\nand two minor doc drifts.\n\nBehavior fix: the \">=-shaped = agent-authored, so leave other shapes alone\"\nguard was only wired into the superseded-key removal path, not the orphan\npath — so a hand-written pin (exact/caret/scoped\n[…]\nely).\n- \"No in-range fix\" sample output updated to the current console text.\n\n157 pass, build clean. Extends the 1.0.0 release PR.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Protect hand-written pins on the orphan path + README audit fixes",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:18:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e37efdc45b311cbe180fb11537c5f3953106aecf",
"body": "First stable release. Renames the CHANGELOG [Unreleased] section to [1.0.0]\nwith a first-stable-release intro, and sets package.json version to 1.0.0.\n\nFrom here the CLI surface (flags, env vars, config schema, exit codes, and\nwhich overrides are written for a given input) is a stable contract under\nSemVer — see the README \"Versioning & stability\" section.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Release 1.0.0",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:06:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d4fd7157ec2861abcdc9bfa061abc3fad6c75ed1",
"body": "Add --exit-code CI drift gate and a cross-platform CI matrix",
"is_bot": false,
"headline": "Merge pull request #29 from michaelpipkin/add-exit-code-and-ci",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:04:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e9169f43ee23e3f160f870935c0e05d21cb59f5",
"body": "The CI matrix surfaced that Node 20 fails: pnpm@11.13.0 refuses to run on\nit (\"requires at least Node.js v22.13\"). Node 20 also reached end-of-life\nin April 2026, so a >=20 floor would claim support for an EOL runtime the\ntoolchain can't even build or test against.\n\n- package.json engines: >=20 -> >=22\n- ci.yml matrix: [20, 22, 24] -> [22, 24] (both already green on Linux+Windows)\n- README requirements + CHANGELOG updated\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Set the Node floor to >=22 for 1.0.0",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:00:47Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f00a880036e4a0ae2fe8c4863ffd63177facf5d2",
"body": "…rep)\n\nCompletes the 1.0.0 groundwork alongside the surface cleanup in this branch.\n\n--exit-code flag (EXIT_CODE=true, config exitCode):\n- When set, the process exits 2 if the run found any override changes; 0 when\n clean; 1 stays \"the tool failed\". Pair with --dry-run to fail CI on override\n drif\n[…]\nuses default discovery (works on Node 20+) scoped to compiled\n JS only. +3 cli.test.ts tests for the flag. 156 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add --exit-code CI drift gate and a cross-platform CI matrix (1.0.0 p…",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:54:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "406ec6b7061d6a5a11a9f8f2cc678f7f84e62b59",
"body": "Declare the CLI-only surface and align repo resolution (1.0.0 prep)",
"is_bot": false,
"headline": "Merge pull request #28 from michaelpipkin/prep-1.0-surface",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:52:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d48c243eef570349ef439a1d240bcc3634dc6240",
"body": "Groundwork for a 1.0.0 release, intended to ship with that version.\n\n- package.json: remove `main`/`types` (they pointed at the CLI entry, which\n runs on import and exports nothing) and add an `exports` restriction, so\n `import \"dependabot-agent\"` and deep imports of internal dist/ modules are\n n\n[…]\n and internal modules explicitly outside the contract.\n\nNo behavior change to the agent's decisions. 153 tests pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Declare the CLI-only surface and align repo resolution (1.0.0 prep)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:28:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "61631a1bf69d2e1e92a83861a4881177c638eb9d",
"body": null,
"is_bot": false,
"headline": "Bump version for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:19:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96f75742ebed6dbd4ed7bd9c6a844c86a0d23823",
"body": "…pm-noise\n\nReport the on-disk override shape; quiet npm ls noise; fix dangling \"via:\"",
"is_bot": false,
"headline": "Merge pull request #27 from michaelpipkin/fix-idempotent-report-and-n…",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:17:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ea6cd2663ecaf919c315395df0032e633a057c8",
"body": "Three observability fixes surfaced by the live add-path smoke test against\nthe pnpm and npm fixture repos (idempotent re-run: scoped overrides already\napplied, so no changes emitted).\n\n1. logMultiLineAdvisories chose \"split into per-line overrides\" vs the flat\n \"forcing one version\" message from T\n[…]\nds\ncleanly. Tests: +4 (effectiveOverrideSpecs; logMultiLineAdvisories scoped-\nvs-flat via captured output). 153 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Report the on-disk override shape; quiet npm ls; fix dangling \"via:\"",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:15:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2e16c21ba69ebb1b2f8f22caddf8c1ef399a7445",
"body": "Bump version for publish",
"is_bot": false,
"headline": "Merge pull request #26 from michaelpipkin/release-0.1.15",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:42:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b695f1423648ab7d78133893d403d6cbbdd86969",
"body": null,
"is_bot": false,
"headline": "Bump version for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:41:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5f3de71e09a0134ebc4896dcdb6fd8b4283cd9f",
"body": "Close #4: pnpm deduped-dependent skip verified safe",
"is_bot": false,
"headline": "Merge pull request #25 from michaelpipkin/close-4-deduped-verified",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:39:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "040408d7102198bddb0965742db8ad269b78d2df",
"body": "Explain why a load-bearing override is kept, not just its latest ranges",
"is_bot": false,
"headline": "Merge pull request #24 from michaelpipkin/explain-load-bearing-keep",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:39:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01ed77878912cdcf17c549c7ed36b7c3ea083be2",
"body": "Captured real `pnpm why uuid --json` from a live pnpm 10 workspace\n(PipSplit). Deduped nodes carry both name and version and no `dependents`,\nand every deduped name@version had a canonical (non-deduped) FIRST\noccurrence in the same output — which is pnpm's dedup model by definition.\nSince collectDep\n[…]\nK \"known edges\" note\n(the only remaining deferred item from the fourth review) is removed.\nDocs/comment only — no behavior change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Close #4: pnpm deduped-dependent skip verified safe against live output",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:36:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e816d42088e7d99050a61990be7261f336f4b397",
"body": "Since removal became strategy-independent (0.1.14), an orphaned override\ncan be kept because a dependent's INSTALLED range dips below the floor even\nwhen its latest range is safe. The keep-load-bearing message never caught\nup: it printed only latestRanges, so such a keep showed safe-looking latest\nv\n[…]\nning the @babel/core shape (installed below floor, latest\nsafe) surfaces the installed range as the reason. 149 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Explain why a load-bearing override is kept, not just its latest ranges",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:29:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e0848ddd3ec726d6c175996839c6b7e2056833cb",
"body": "Bump version for publish",
"is_bot": false,
"headline": "Merge pull request #23 from michaelpipkin/release-0.1.14",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:17:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ef0e6ae7e1fdfabaf29fec00d24031e638b297f",
"body": null,
"is_bot": false,
"headline": "Bump version for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:17:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "59e9d613a66fd75c82944be94a35704ad9f30418",
"body": "Cover uncovered scoped majors; preserve user pins and nested overrides",
"is_bot": false,
"headline": "Merge pull request #22 from michaelpipkin/fix-scoped-major-coverage",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1429fa43a23743c3761e5546ebc03589e93e81cb",
"body": "A fourth independent adversarial review confirmed the removal/orphan path\nis now sound (it couldn't break it) and pivoted to the scoped-WRITE path.\nThree findings, all verified and fixed; a fourth is documented for live\nverification.\n\n#1 (medium, security): computeScopedSpecs bailed to the flat over\n[…]\nd CHANGELOG under [Unreleased].\n\nTests: +3, each verified to discriminate (fails when its fix is reverted).\n148 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Cover uncovered scoped majors; preserve user pins and nested overrides",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:14:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a7aa51580c07a9343228ed0f75bc27629f7869f6",
"body": "…moval\n\nMake override removal strategy-independent and honor dismissed alerts",
"is_bot": false,
"headline": "Merge pull request #21 from michaelpipkin/fix-strategy-independent-re…",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:50:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c58509de7e684f6799410e0971d5c819f9474e9",
"body": "A third independent adversarial review confirmed the whole codebase\noutside the removal path is sound, and found three more issues in the\nremoval path. All three point the same way: removal must not depend on\nupdate strategy or treat an acknowledged vulnerability as gone.\n\n#1 (high, security): judge\n[…]\n-bound ranges (#2). Each fix verified\nto discriminate (its regression test fails when the fix is reverted).\n145 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Make override removal strategy-independent and honor dismissed alerts",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:47:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "77713584b3d1eb05c98766b8234d0c879de34383",
"body": "…oval\n\nNever remove a load-bearing override for a still-open alert",
"is_bot": false,
"headline": "Merge pull request #20 from michaelpipkin/fix-open-alert-override-rem…",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:07:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f0fb0d3431efd606be3b6e6fc03711ce97883b66",
"body": "An independent adversarial review of the whole codebase confirmed the\n0.1.13 removal-safety fixes hold, but surfaced a new high-severity path\nin the same catastrophic direction, plus a low report-noise issue.\n\nFinding #1 (high, security): the removal pass in computeOverrideChanges\nmatched existing o\n[…]\nrivation is disabled); the escape-refinement helper is\nunit-tested for the scoped, flat, and no-copy cases. 143 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Never remove a load-bearing override for a still-open alert",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:04:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8d673e04eb64c3d9f5949a4ebf21d9ad270ceb1c",
"body": "Strip build metadata in parseSemver (review finding #5)",
"is_bot": false,
"headline": "Merge pull request #19 from michaelpipkin/fix-parse-build-metadata",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:36:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af1a2f81fe172c281582966850100de645ab4c32",
"body": "parseSemver dropped the pre-release suffix but not build metadata, so a\nversion like 1.2.3+build failed the digit-segment check and parsed as\nnull, sending callers to their conservative branch. Build metadata is\nignored for precedence per the semver spec, so it is now stripped too\n(via split(/[-+]/)\n[…]\n ordering would be a large refactor to fix only the rare\npre-release-as-installed-version case. The doc comment now explains this.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Strip build metadata in parseSemver (review finding #5)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:34:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "397f060229f7297e85a2d68493bdac6f43b5912a",
"body": "Fix four override-removal safety issues from the independent review",
"is_bot": false,
"headline": "Merge pull request #18 from michaelpipkin/fix-review-findings",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:26:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "04a6f9bd91a1286b018162d87303cfcda9463b89",
"body": "Makes this PR the 0.1.13 security release: package.json -> 0.1.13 and the\n[Unreleased] heading renamed to [0.1.13]. Merging publishes the removal-safety\nfixes to npm.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment (0.1.13)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:24:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c6aea7860f2c70ba699a0943b196228161b30bd6",
"body": "An adversarial README-vs-code review found the removal / orphan half of the agent\nunder-delivering the conservatism the README promises. Each could remove a\nstill-load-bearing override and reintroduce the CVE it held back.\n\n#1 (confirmed, live since 0.1.10): scoped keys judged against the LOWEST flo\n[…]\ngy-aware judge cases,\nsub-major fallback, all with discrimination against the pre-fix behaviour.\nShips as 0.1.13 (security patch).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix four override-removal safety issues from the independent review",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:16:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "00e2d2f53a1d1b23f93768528de471ae8623bbe7",
"body": "Bump to 0.1.12: correct the README to match shipped behavior",
"is_bot": false,
"headline": "Merge pull request #17 from michaelpipkin/docs-scoped-and-removal",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:32:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b028fec74ca0efeed40d4b710a7690d8c3ea38f",
"body": "README-only changes reach npm solely through a version bump, so this bundles the\ndoc fixes with the 0.1.12 bump.\n\n- \"What it does\" step 6 now notes that a multi-line advisory is fixed with one\n scoped override per release line (js-yaml@3 / js-yaml@4), not just a flat\n bounded spec -- the headline \n[…]\nones, with the conservative caveats.\n\nNo code change. package.json -> 0.1.12, CHANGELOG [0.1.12] documents why the\nrelease exists.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump to 0.1.12: correct the README to match shipped behaviour",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:31:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6fbfd3ae2d652f5c6b5f0d9a3d8122e07f339c1d",
"body": "Bump version numbers for deployment (0.1.11)",
"is_bot": false,
"headline": "Merge pull request #16 from michaelpipkin/release-0.1.11",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:22:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df2a52c83e45816169786e6139f85bd0bb2fb6e9",
"body": "Ships the workspace-internal override aging-out (#14) and the clean-exit fix for\na failed alert fetch (#12). package.json -> 0.1.11 and the [Unreleased] heading\nrenamed to [0.1.11].\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment (0.1.11)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:22:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "2a96c17bb980014e830a34056fd95652ceac79de",
"body": "Age out overrides whose only dependents are workspace-internal (#14)",
"is_bot": false,
"headline": "Merge pull request #15 from michaelpipkin/age-out-workspace-overrides",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:20:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8eaf55082085b120ef3086f8cf3cb9b052d1d3a",
"body": "Removing an override with no open alert asks \"has upstream moved on?\" by reading\nthe dependents' latest ranges from the npm registry. A workspace member has no\nregistry entry, so collectDependentRanges dropped it -- and an override reachable\nonly through workspace members was kept forever, even afte\n[…]\n, the local\nrange read, and the remove/keep verdicts -- no registry needed, since this path\nreads local manifests. 130 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Age out overrides whose only dependents are workspace-internal (#14)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:18:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9e5ef3a6ce10fa8bdfa42d788ca02f2b4f4b62f5",
"body": "Exit cleanly on a failed alert fetch instead of a libuv crash (#12)",
"is_bot": false,
"headline": "Merge pull request #13 from michaelpipkin/fix-fetch-error-crash",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:00:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e07a888db83a8f6158d4ecbca0ea3cb0cd6bd43a",
"body": "Fixes #12. When fetchDependabotAlerts failed (bad token, alerts disabled,\nnetwork error, any non-2xx), the agent printed the right error and then aborted\nwith `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)` and exit code 127\ninstead of 1.\n\nCause: exitWithError called process.exit(1) synchro\n[…]\ntion, no\nhang); a successful run still exits 0; --help exits 0; missing-token and\nunknown-arg still print clean errors and exit 1.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Exit cleanly on a failed alert fetch instead of a libuv crash",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:56:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3b57b290267abe159708446d24c88251ce2151ce",
"body": "Scenario test infrastructure: captured fixtures + offline replay + runbook",
"is_bot": false,
"headline": "Merge pull request #11 from michaelpipkin/scenario-test-fixtures",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:43:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77b1cae6bd316fbbad20751020c8413b99b99a94",
"body": "Prove and regression-test orphan-override removal (#2)",
"is_bot": false,
"headline": "Merge pull request #10 from michaelpipkin/prove-orphan-removal",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:43:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e637ab177c538b7281bc2a553d4daabe50e3288",
"body": "…+ runbook\n\nMakes the four scenarios the agent exists for -- add and remove an override, on\npnpm and npm -- cheap to reproduce and regression-test when future issues arrive.\n\nThe live fixtures proved the mechanisms once, but they're a poor maintenance base:\nthey wait on Dependabot scans, need a toke\n[…]\nr capture\nthe triggering payload into test/fixtures/), add a failing scenario test, fix,\nconfirm the live smoke test still passes.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add scenario test infrastructure: captured fixtures + offline replay …",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:39:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a84351d57fec025f77ba1439570d27b9bd357940",
"body": "The last open item on #2: the \"a parent updates upstream to a non-vulnerable\ntransitive version, so the override ages out\" loop was never exercised\nend-to-end. It's the orphan path (reconcileOrphanedOverride), which decides\nremoval from npm REGISTRY data, so a local package fixture couldn't drive it\n[…]\n verdicts, including that removal reads\nthe LATEST range (forward-looking) and never infers \"safe to remove\" from an\nabsent range.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Prove and regression-test orphan-override removal",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:32:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9e26f7826f72ceb5e0ded16d65b708b862913c5a",
"body": "Bump version numbers for deployment (0.1.10)",
"is_bot": false,
"headline": "Merge pull request #9 from michaelpipkin/release-0.1.10",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:21:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34c28325c67683194f18506d131e4ee9827e394c",
"body": "Ships scoped per-line overrides for multi-line advisories, universal across pnpm\nand npm via the version-selector mechanism (#7, #8). package.json -> 0.1.10 and\nthe [Unreleased] heading renamed to [0.1.10].\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment (0.1.10)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:18:43Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6852ca6400802b5bcec64941d0079642206111ff",
"body": "Make scoped overrides idempotent; teach the orphan path scoped keys",
"is_bot": false,
"headline": "Merge pull request #8 from michaelpipkin/fix-scoped-idempotency",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:14:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e52fcbeb1340f870b73a4281175bef0a8a01de2",
"body": "Proving the scoped feature end-to-end on a live npm workspace fixture surfaced a\nreal usability gap: npm resolves from the existing node_modules + package-lock.json\nand does NOT re-resolve when `overrides` changes. A plain `npm install` -- and\n--force, and --package-lock-only -- all leave the vulner\n[…]\n its own patched line (3.15.0, 4.3.0), and Dependabot closed all\nfour lockfile alerts -- npm scoped support proven, matching pnpm.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "npm: tell users a clean install is needed to apply new overrides",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:12:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a3c21451102ef62931e2a7e96537e0d064e69de9",
"body": "The scoped path was documented as pnpm-only with an npm flat-max fallback, on the\nbelief that npm overrides can't express a version selector. A probe disproves it:\nnpm honors a `js-yaml@3` override key, including for registry-transitive copies,\nand applies it on a plain `npm install`. (My earlier pr\n[…]\ne.json `overrides` block and pnpm-workspace.yaml.\n\nNo behaviour change — this makes the docs match what the code does and pins it.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Scoped overrides work on npm too — version-selector, not just pnpm",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T15:55:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "621713767fc8dd4437e626462699bd3e3bd9bcf6",
"body": "Two defects in the scoped-override path (0.1.10, unreleased), both found by running\nthe agent against the fixture a second time.\n\n1. Not idempotent — it un-wrote its own fix. computeScopedSpecs grouped by the\n INSTALLED versions to find the release lines, but once the override is applied\n the tr\n[…]\nry run against the fixture is now a clean no-op where before\nit planned to revert to the flat override and delete the scoped keys.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Make scoped overrides idempotent; teach the orphan path scoped keys",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T15:29:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a9fb021529bbb2265601cc3b0312508def6fdc28",
"body": "Scoped per-line overrides for multi-line advisories (pnpm)",
"is_bot": false,
"headline": "Merge pull request #7 from michaelpipkin/scoped-overrides-multiline",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T15:06:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0be594e3134ae203249987200b03f45fd4fb9171",
"body": "GitHub keys a member's direct-dependency alert to packages/x/package.json.\ngroupAlertsByManifestDir grouped strictly by that path, so a workspace member\nthat shares the root lockfile was treated as its own isolated package: the agent\nselected a member-local pnpm-workspace.yaml as the override source\n[…]\nly isolated package still owns its overrides. Surfaced by running the\nscoped-override feature end-to-end against the fixture repo.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fold shared-lockfile workspace members into the root override group",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T14:59:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "00d2e2d3e4204cf5c385cb79edc08b3c1dcf27ba",
"body": "Detection (0.1.9) reported when a package is vulnerable on disjoint release\nlines; this resolves it. Instead of the flat max -- which hands one version to\nevery consumer and drags the lower line across a major no advisory demands --\ncomputeOverrideChanges now writes one bounded override per line usi\n[…]\n(name@0 is too broad, since a 0.x line is a minor). Scoped npm\nsupport needs a nested-override model change and is deferred to #2.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix multi-line advisories with per-line scoped overrides (pnpm)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T14:53:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1239eea82161da87a73065395250a80c7c80a6cf",
"body": "getInstalledTree ran `pnpm list --json --depth=Infinity` without -r, so in a\nshared-lockfile pnpm workspace a dependency declared only in a packages/* member\nwas invisible at the root. findInstalledVersions returned empty, the package was\nskipped before detection ran, and no override was written -- \n[…]\nied on the multi-line fixture: -r surfaces js-yaml under both\nconsumer-old and consumer-new, where the root-only read saw neither.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "See workspace member deps: pnpm list -r",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T14:29:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a6bf60703294be212d987611c6068867f345e14b",
"body": "Bump version numbers for deployment (0.1.9)",
"is_bot": false,
"headline": "Merge pull request #6 from michaelpipkin/release-0.1.9",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:31:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17f048a93adb58ca5f44e29f86aea14113b08ee1",
"body": "Ships the multi-line advisory detection merged in PR 5. Releasing it now rather\nthan holding it for the scoped-override work, because the two repos that consume\nthis agent take it from npm -- pip-cost-sharing on a Monday 06:00 cron -- so an\nunreleased detector detects nothing. Its whole purpose is t\n[…]\nuntil the next one arrives. An informational-only change that cannot alter an\noverride is the right thing to ship into that quiet.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:30:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5e5a0362227fed8062159988966f7123ba57658e",
"body": "Report multi-line advisories instead of firing silently (#4)",
"is_bot": false,
"headline": "Merge pull request #5 from michaelpipkin/detect-multiline-advisories",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:22:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d6417f256c23fa61c875f2409bf7b4a3b0fdb75",
"body": "An advisory carries one vulnerable range per release line, each with its own\nfirst_patched_version, so a package vulnerable on two lines at once has no single\npatched version. mergeAlert takes the max -- deliberately, per #3: it is the only\nchoice that can't leave a vulnerable copy quietly resolvabl\n[…]\nal tar case -- seven nested advisories on one line,\nwhere the max IS the minimum and reporting anything would be a false positive.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Report multi-line advisories instead of firing silently (#4)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:19:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1c50979e417eecc5ed423ee714b46877568a1e75",
"body": "Settle the multi-line advisory question in favor of max (#2)",
"is_bot": false,
"headline": "Merge pull request #3 from michaelpipkin/settle-multiline-advisory-max",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T20:41:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd67834294e1edcdb0e0faecf341bb416a4d74b9",
"body": "Issue #2 flagged that mergeAlert keeps the highest first_patched_version across\na package's alerts, which can force a tree onto a newer major than any advisory\nrequires: an advisory carries one vulnerable range per release line, each with\nits own patch, so GHSA-mh29-5h37-fv8m patches js-yaml's \"< 3.\n[…]\n-- the only mechanism that can hand\ndifferent consumers different versions, and still a feature with a design rather\nthan a patch.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Settle the multi-line advisory question in favor of max (#2)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T20:36:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b72f53e6bd0826f39322637cd2083523a80977fb",
"body": "README:413 and mergeAlert's comment both stated \"highest first_patched_version\nwins\" as settled intent, with no hint that a package can have more than one\npatched version. An advisory carries one vulnerable range per release line, each\nwith its own patch -- GHSA-mh29-5h37-fv8m has \"< 3.14.2 -> 3.14.\n[…]\n the current\nbehaviour wrong).\n\nBoth sites now point there, so the claim stops reading as considered when it is\nmerely unexamined.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Flag the multi-line advisory assumption at both sites (#2)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T18:50:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "92c254fb50c45afca6b59ea13d94170e9fa6e06f",
"body": null,
"is_bot": false,
"headline": "Bump version numbers for deployment",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T17:42:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fd48ca1a1dab030f213e8f5e57db79d38c6ee38",
"body": "A full run against a live tree disproved two claims this tool was making.\n\nThe guidance called escapes with an upstream fix \"stale dependents\" and said\nthat \"moving off the installed version clears the escape\". For vite it does\nnot: @angular/build@22.0.6 -- itself the latest release -- declares\n`vit\n[…]\ning only, no logic change -- but output that promises a fix the user cannot\napply is worse than output that admits the constraint.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Say an upstream fix exists, not that you can reach it",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T17:31:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "816f1b6b491d0449bcb844d599fa180599190dad",
"body": "Git Bash can export PNPM_HOME as /c/Users/you/AppData/Local/pnpm. It converts\nthat to Windows form when IT launches a native binary, so a hand-typed\n`pnpm update` works -- which is what made this confusing to diagnose. A pnpm\nspawned by this agent inherits the raw POSIX value, derives its store as\n\\\n[…]\n at the next \"## [\", so the\nsecond section's entries would have been dropped from the release notes\nwithout ever failing anything.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Repair POSIX PNPM_HOME on Windows before shelling out",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T17:21:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ebe943ffc9cb87488f0bc0a4e7a5d61510bb2926",
"body": "Every path rendered as the queried package's own name -- \"tar - via: tar\",\n\"uuid - via: uuid\" -- which told the reader nothing. walkDependents seeded\npathLabel with entry.name (the package being queried), so the\n`pathLabel || `${dep.name}@${dep.version}`` fallback was dead code: pathLabel\nwas truthy\n[…]\n's scope says.\n\nThe npm implementation labels from edge.name, which is already the root's\ndirect dependency, and needed no change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Label deployment-impact paths with the real dependency (pnpm)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T16:59:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c9a0e8222a8b89aa66188003fbe7ad47a33252b",
"body": "Both bugs surfaced on the first run against real alerts.\n\nfindInstalledVersion returned the first hit of a tree walk, documenting the\nassumption that \"all instances should be the same version after the package\nmanager resolves with any existing overrides applied.\" That is backwards: it\nholds after a\n[…]\nerified against the live tree: escapes 2 -> 4 (tar and esbuild now caught),\nand scope now matches Dependabot on all five packages.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Check every installed copy; take scope from Dependabot",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T16:49:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "410c728ed4902b692aa4e2024be7149fe774abf9",
"body": "Three changes to the no-in-range-fix report, all driven by what it actually\nprinted against a real tree.\n\nJudge by the resolved version, not the spec floor. An unbounded override can\nsit far above its own floor: pip-cost-sharing's uuid override reads\n\">=11.1.1\" but had resolved to 14.0.1, and js-yam\n[…]\nscapes caused purely by\na stale dependent show up but would not survive a real run. Say so rather\nthan let the list read as final.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Judge escapes by the resolved version; split them by actionability",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T15:38:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b3f50013d01fe1767e32edd55b7dff7783781049",
"body": "collectDependentRanges found each dependent from the tree -- where pnpm why\nand npm explain both report its installed version -- collected the names\ninto a Set, dropped the versions, and then read the declared range from the\ndependent's `latest` manifest. Latest can declare something entirely\ndiffer\n[…]\nme package can appear at\nseveral versions declaring different ranges. Internal interface only -- no\nCLI or config surface changes.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Resolve dependent ranges at the installed version, not latest",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:53:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e525ed0cc708ae7ad8d918bf909f59cfb7f02bca",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add changelog entry for orphan-path escape detection",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:38:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "eeedf26a62654e9001330d0bb710eb831e8f4371",
"body": "0.1.5 wired the escape check into computeOverrideChanges only, which\nhandles overrides driven by an open alert. Overrides with no open alert go\nthrough reconcileOrphanedOverride instead, which asked only \"is this still\nload-bearing?\" and reported every kept override identically. A repo with\nzero ope\n[…]\n work in one\nplace, and findEscapingRanges/overrideFloor as pure functions so the six real\noverrides above serve as test fixtures.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Detect no-in-range-fix on the orphan path too",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:38:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ca86cbf631ef4162ea8a8f872fecbe9e3767b90",
"body": "An override that forces a package outside its dependents' compatible\nrange installs cleanly and closes its Dependabot alert, so nothing in the\npipeline surfaced it. These are now reported separately from routine\nchanges, with a marker, a warning block, and a summary count.\n\nThe boundary follows npm'\n[…]\nckage.\n\nCorrect two README claims that overrides \"never\" force a breaking major\nbump. They can and do when no in-range fix exists.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Flag overrides with no in-range fix; fix 0.x compatibility bounds",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:04:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c768860e7d14344066065dde200e68753b834639",
"body": null,
"is_bot": false,
"headline": "Update package.json",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-12T18:37:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de0181146d17c7a0e185de11f786445e980b744a",
"body": null,
"is_bot": false,
"headline": "Update package version for deployment",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-12T18:30:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea1911f2fe2d01375153dfd2a11415471e06b9d5",
"body": null,
"is_bot": false,
"headline": "Add license and update README",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-12T18:30:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0deefc9f11d9dce6f75b995fb566cf603a8028d3",
"body": "actions/checkout@v7, actions/setup-node@v6, pnpm/action-setup@v6 —\nclears the Node 20 runtime deprecation warning. [no-deploy]\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump workflow actions to Node 24 majors",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T02:04:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a0299f679e1e8fdc067b794c7afd09121366cc3c",
"body": "This is a pnpm project (pnpm-lock.yaml is the tracked lockfile), so\nmaintain a single lockfile. Install/build with pnpm; keep `npm publish`\nfor OIDC Trusted Publishing (publish needs no lockfile). Pin the pnpm\nversion via the packageManager field. [no-deploy]\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Switch CI to pnpm; drop package-lock.json",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T02:01:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0d8433bf9979324ea204ee9e73c51a48803f5e9b",
"body": "The publish workflow uses `npm ci`, which requires a committed\nlockfile. Generate one from package.json to fix the failing\n\"Install dependencies\" step. [no-deploy]\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add package-lock.json so CI npm ci can install",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T01:56:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b150ff253c81ea7e4d11cfd433b27114fc4b3e79",
"body": null,
"is_bot": false,
"headline": "Add pusblish workflow",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T01:36:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e370a50ae146dca80142cdb25dce6b33af992ada",
"body": null,
"is_bot": false,
"headline": "Update README",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T00:14:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7fe8aef7606944b8a3f923c6d84fcb50371f5b13",
"body": null,
"is_bot": false,
"headline": "Fix version bounding bug",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-24T00:42:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc9a62aa3c9757ddea128657a954c382186cfaa0",
"body": null,
"is_bot": false,
"headline": "Update documentation",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-23T22:31:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ddd040845a9a444e7cc0111592e3ef6ed817d6e6",
"body": "Npm",
"is_bot": false,
"headline": "Merge pull request #1 from michaelpipkin/npm",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T18:36:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "056f8d57b449f017c60f13044e9d1ab98592a48c",
"body": null,
"is_bot": false,
"headline": "Set version and author to prep for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T03:37:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d8abb4fb7b1142d9c49b161a58f81924244a89c",
"body": null,
"is_bot": false,
"headline": "Update to find all package manifests",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T03:21:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "533519ddb50299cf53e1f8d73c53b61cb9e1a4ea",
"body": null,
"is_bot": false,
"headline": "Refactor to generic CLI tool",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T02:47:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "47a976d51c30f220dfeeac9e8c8fd6d955752cb2",
"body": null,
"is_bot": false,
"headline": "Initial project setup",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T01:45:54Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 15,
"commits_last_year": 87,
"latest_release_at": "2026-07-20T14:57:09Z",
"latest_release_tag": "v1.0.2",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 4,
"days_since_latest_release": 6,
"mean_days_between_releases": 0.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": false,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "dependabot-agent",
"exists": true,
"license": "MIT",
"keywords": [
"dependabot",
"overrides",
"npm",
"pnpm",
"security",
"vulnerabilities",
"cli"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/dependabot-agent",
"is_deprecated": false,
"latest_version": "1.0.2",
"repository_url": "https://github.com/michaelpipkin/dependabot-agent",
"versions_count": 20,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 2659,
"first_published_at": "2026-06-22T03:40:16.937000Z",
"latest_published_at": "2026-07-20T14:57:05.915000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 59036,
"source_files_sampled": 25,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 2,
"malicious_count": 0,
"assessed_package": "npm:dependabot-agent@1.0.2",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "js-yaml",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.1.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 27,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 4,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "michaelpipkin",
"commits": 87,
"avatar_url": "https://avatars.githubusercontent.com/u/5658291?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 2,
"reason": "3 out of 13 merged PRs checked by a CI test -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/15 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "437b62155f885282555871ecf3f3c93cfe8aee1b",
"ran_at": "2026-07-27T01:33:33Z",
"aggregate_score": 3.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-20T14:57:13Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-17T00:31:15Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/michaelpipkin/dependabot-agent",
"host": "github.com",
"name": "dependabot-agent",
"owner": "michaelpipkin"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"security": 49,
"vitality": 74,
"community": 32,
"governance": 55,
"engineering": 47
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"commits_last_year": 87,
"human_commit_share": 1,
"days_since_last_push": 6,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "87 commits in the last year",
"points": 17.5,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 87
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 15,
"latest_release_tag": "v1.0.2",
"releases_from_tags": false,
"days_since_latest_release": 6,
"mean_days_between_releases": 0.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "15 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 15
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 32,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 57,
"inputs": {
"packages": [
"dependabot-agent"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 2659
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,659 downloads/month across npm",
"points": 45.7,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2659,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"merged_prs": 27,
"open_issues": 0,
"closed_issues": 4,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "27/27 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 27,
"decided": 27
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/15 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 41,
"inputs": {
"followers": 2,
"owner_type": "User",
"is_verified": null,
"owner_login": "michaelpipkin",
"public_repos": 10,
"account_age_days": 4672
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2 followers of michaelpipkin",
"points": 3.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2,
"login": "michaelpipkin"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~12 yr old",
"points": 19.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 12
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"dependabot-agent"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 6
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 6 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 6
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "20 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 20
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 47,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "3 out of 13 merged PRs checked by a CI test -- score normalized to 2",
"points": 4,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "at_risk",
"name": "Documentation",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 49,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 36,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 3.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "3 out of 13 merged PRs checked by a CI test -- score normalized to 2",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/15 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:dependabot-agent@1.0.2 runtime dependency closure — what installing the published package pulls in — 2 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:dependabot-agent@1.0.2",
"assessed": 2
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 2,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 2,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.805,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "70 of 87 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 70,
"sampled": 87
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.506,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "44 of the last 87 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 44,
"sampled": 87
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 59036,
"source_files_sampled": 25,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/25 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 25,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-27T01:33:47.962573Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/m/michaelpipkin/dependabot-agent.svg",
"full_name": "michaelpipkin/dependabot-agent",
"license_state": "standard",
"license_spdx": "MIT"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — npm.