Public record
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-24 19:22 UTC

cameronsjo / bosun

GitOps for Docker Compose on bare metal

GoMIT★ 1 star⑂ 0 forkssince Dec 2025View on GitHub ↗

cameronsjo/bosun holds a health index of 61 out of 100, placing it in the Moderate band. It scores highest on AI Readiness (87/100) and lowest on Community & Adoption (33/100). It was last updated 3 days ago. A single contributor accounts for most of its recent work.

61
overall / 100
Moderate

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

61
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
VitalityCommunity &AdoptionSustainability &GovernanceEngineeringQualitySecurityAI Readiness

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

Ownership

Cameron SjoPersonal account
16 followers73 public repossince Apr 2013

This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.

Package ecosystems

RegistryPackageVersionDownloads / moVersionsLast publish
Gogithub.com/cameronsjo/bosunv0.39.3-954 days ago

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

82Good · 22% of overall

Development activity

76Good
How it's scored
36/36Push recency — last push 3 days ago
11.8/36Commit cadence — 17/52 weeks with commits
18/18Commit volume — 934 commits in the last year
10/10OpenSSF Scorecard: Maintained — 30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10
Inputs used
commits_last_year934
human_commit_share0.47
days_since_last_push3
active_weeks_last_year17

Release discipline

90Excellent
How it's scored
27/27Ships releases — 95 releases published
36/36Release recency — latest release 4 days ago
27/27Release cadence — a release every ~0.2 days
0/10OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases.
Inputs used
releases_count95
latest_release_tagv0.39.3
releases_from_tagsno
days_since_latest_release4
mean_days_between_releases0.2

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

33At risk · 18% of overall

Popularity & adoption

1Critical
How it's scored
0/60Stars — 1 stars
0/25Forks — 0 forks
0/15Watchers — 0 watchers
Inputs used
forks0
stars1
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Community health

70Good
How it's scored
22.5/22.5README
22.5/22.5License — recognized license (MIT)
18/18CONTRIBUTING guide
0/13.5Code of conduct
0/7.2Issue template
0/6.3PR template
Inputs used
has_readmeyes
has_licenseyes
has_contributingyes
has_issue_templateno
has_code_of_conductno
has_pull_request_templateno

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

54Moderate · 24% of overall

Maintainer resilience (bus factor)

15Critical
How it's scored
9/54Bus factor — 1 contributor(s) cover half of all commits
0.2/22.5Commit distribution — top contributor authored 99% of commits
2.7/13.5Contributor breadth — 2 contributors
3/10OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3
Inputs used
bus_factor1
contributors_sampled2
top_contributor_share0.992

Issue & PR responsiveness

62Moderate
How it's scored
25.9/46.8Issue resolution — 56% of issues closed
35.9/38.3PR acceptance — 264/281 decided PRs merged
0/15OpenSSF Scorecard: Code-Review — Found 1/12 approved changesets -- score normalized to 0
Inputs used
merged_prs264
open_issues81
closed_issues101
issue_closed_ratio0.555
closed_unmerged_prs17

Ownership & stewardship

55Moderate
How it's scored
10/30Ownership backing — personal (user) account
0/20Verified domain — not applicable to user accounts
8.8/25Owner reach — 16 followers of cameronsjo
25/25Track record — 73 public repos, account ~13 yr old
Inputs used
followers16
owner_typeUser
is_verified—
owner_logincameronsjo
public_repos73
account_age_days4,856
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.

Package maintenance

100Excellent
How it's scored
25/25Published & resolvable — 1 package(s) on go
35/35Publish recency — latest publish 4 days ago
20/20Version history — 95 published versions
20/20Not deprecated — active, not deprecated or yanked
Inputs used
packagesgithub.com/cameronsjo/bosun
ecosystemsgo
any_deprecatedno
min_days_since_publish4

Engineering Quality

Are baseline engineering and documentation practices in place?

76Good · 20% of overall

Engineering practices

76Good
How it's scored
24/24CI workflows — 6 workflow(s)
24/24Tests present
16/16Linter config — .golangci.yml, eslint.config.js
0/9.6Pre-commit hooks
0/6.4.editorconfig
12/20OpenSSF Scorecard: CI-Tests — 14 out of 21 merged PRs checked by a CI test -- score normalized to 6
Inputs used
has_ciyes
has_testsyes
has_editorconfigno
has_linter_configyes
has_precommit_configno

Documentation

75Good
How it's scored
30/30README
25/25Documentation directory
0/15Documentation / homepage site
10/10Repository description
0/10Topics
10/10Wiki
Inputs used
topics—
has_wikiyes
homepage—
has_readmeyes
has_docs_diryes
has_descriptionyes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

57Moderate · 16% of overall

Security posture

49At risk
How it's scored
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
1.5/2.5CI-Tests — 14 out of 21 merged PRs checked by a CI test -- score normalized to 6
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 1/12 approved changesets -- score normalized to 0
0.8/2.5Contributors — project has 1 contributing companies or organizations -- score normalized to 3
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5License — license file detected
7.5/7.5Maintained — 30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10
5/5Packaging — packaging workflow detected
0.5/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1
0/5SAST — SAST tool is not run on all commits -- score normalized to 0
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
3.8/7.5Vulnerabilities — 5 existing vulnerabilities detected
Inputs used
sourceopenssf_scorecard
checks_evaluated18
scorecard_versionv5.5.0
checks_inconclusive0
scorecard_aggregate4.9

Dependency advisories

89Excellent
How it's scored
26.6/35Direct dependencies free of known advisories — 1 affected: golang.org/x/crypto v0.53.0 (unknown)
0/25Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
40/40No advisories left outstanding — no advisory has been public longer than 90 days
Inputs used
sourceosv
advisories5
affected_packages5
assessed_packages421
unassessed_packages0
affected_by_severitycritical 1, high 1, low 1, unknown 2
direct_affected_packages1
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 421 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

87Excellent · 0% of overall

Agent context & guidance

100Excellent
How it's scored
45/45Agent instructions — .clinerules, .cursorrules, .github/copilot-instructions.md, .windsurfrules, AGENTS.md, CLAUDE.md, GEMINI.md, openspec/AGENTS.md
15/15Machine-readable docs (llms.txt) — llms.txt present
40/40Legible commit history — 47 of 47 human commits state their intent (structured subject or explanatory body)
Inputs used
has_llms_txtyes
legible_history_share1
agent_instruction_files.clinerules, .cursorrules, .github/copilot-instructions.md, .windsurfrules, AGENTS.md, CLAUDE.md, GEMINI.md, openspec/AGENTS.md
agent_instruction_max_bytes27,289

Verify loop (build / test / typecheck)

91Excellent
How it's scored
18/18One-command bootstrap — Makefile
22/22Automated tests
11/11Lint / format config — .golangci.yml, eslint.config.js
11/11Static type checking — webui/tsconfig.json
10/10Reproducible environment — Dockerfile, lockfile
10/10Demonstrated agent practice — 37 of the last 100 commits agent-authored or agent-credited
8/8Automated maintenance — 9 of the last 100 commits are automated dependency updates
1/10OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1
Inputs used
has_nixno
has_testsyes
lockfilesgo.sum, package-lock.json, pnpm-lock.yaml, uv.lock
has_dockerfileyes
typed_languageyes
bootstrap_filesMakefile
has_devcontainerno
has_linter_configyes
typecheck_configswebui/tsconfig.json
agent_commit_share0.37
toolchain_manifestsdagger/go.mod, go.mod
dependency_bot_commit_share0.09

Code legibility for models

99Excellent
How it's scored
45/45Type-checkable code — Go (statically typed)
53.9/55Manageable file sizes — 5/253 source files over 60KB
Inputs used
primary_languageGo
largest_source_bytes186,708
source_files_sampled253
oversized_source_files5

Machine-readable interfaces

40At risk
How it's scored
0/40API schema (OpenAPI/GraphQL/proto)
0/20MCP server
40/40Runnable examples — examples
Inputs used
example_dirsexamples
has_mcp_signalno
api_schema_files—

Key facts

1GitHub stars
2contributors
934commits, last 12 months
3days since last push
95releases
1bus factor
81open issues
Go, npmpackage ecosystems

Data collection warnings

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token

More detail

OpenSSF Scorecard 4.9 / 10
4.9aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-24 19:21 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
6CI-Tests14 out of 21 merged PRs checked by a CI test -- score normalized to 6
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 1/12 approved changesets -- score normalized to 0
3Contributorsproject has 1 contributing companies or organizations -- score normalized to 3
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10
10Packagingpackaging workflow detected
1Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 1
0SASTSAST tool is not run on all commits -- score normalized to 0
10Security-Policysecurity policy file detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
5Vulnerabilities5 existing vulnerabilities detected
Direct dependencies 26
RegistryPackageVersion constraintManifest
Gogithub.com/Masterminds/sprig/v3v3.3.0go.mod
Gogithub.com/bmatcuk/doublestar/v4v4.10.0go.mod
Gogithub.com/creativeprojects/go-selfupdatev1.6.0go.mod
Gogithub.com/fatih/colorv1.19.0go.mod
Gogithub.com/getsentry/sentry-gov0.47.0go.mod
Gogithub.com/getsentry/sentry-go/zerologv0.47.0go.mod
Gogithub.com/getsops/sops/v3v3.13.2go.mod
Gogithub.com/go-git/go-git/v5v5.19.1go.mod
Gogithub.com/google/uuidv1.6.0go.mod
Gogithub.com/kballard/go-shellquotev0.0.0-20180428030007-95032a82bc51go.mod
Gogithub.com/moby/moby/apiv1.55.0go.mod
Gogithub.com/moby/moby/clientv0.5.0go.mod
Gogithub.com/prometheus/client_golangv1.23.2go.mod
Gogithub.com/rs/zerologv1.35.1go.mod
Gogithub.com/spf13/cobrav1.10.2go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogo.opentelemetry.io/otelv1.44.0go.mod
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.44.0go.mod
Gogo.opentelemetry.io/otel/sdkv1.44.0go.mod
Gogo.opentelemetry.io/otel/tracev1.44.0go.mod
Gogolang.org/x/cryptov0.53.0go.mod
Gogolang.org/x/sysv0.47.0go.mod
Gogolang.org/x/termv0.44.0go.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
npmreact^19.2.7webui/package.json
npmreact-dom^19.2.7webui/package.json
All dependencies 421

Full resolved dependency set from the GitHub dependency graph: 26 direct and 395 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

RegistryPackageVersionRelation
Gogithub.com/bmatcuk/doublestar/v4v4.10.0direct
Gogithub.com/creativeprojects/go-selfupdatev1.6.0direct
Gogithub.com/fatih/colorv1.19.0direct
Gogithub.com/getsentry/sentry-gov0.47.0direct
Gogithub.com/getsentry/sentry-go/zerologv0.47.0direct
Gogithub.com/getsops/sops/v3v3.13.2direct
Gogithub.com/go-git/go-git/v5v5.19.1direct
Gogithub.com/google/uuidv1.6.0direct
Gogithub.com/kballard/go-shellquotev0.0.0-20180428030007-95032a82bc51direct
Gogithub.com/masterminds/sprig/v3v3.3.0direct
Gogithub.com/moby/moby/apiv1.55.0direct
Gogithub.com/moby/moby/clientv0.5.0direct
Gogithub.com/prometheus/client_golangv1.23.2direct
Gogithub.com/rs/zerologv1.35.1direct
Gogithub.com/spf13/cobrav1.10.2direct
Gogithub.com/stretchr/testifyv1.11.1direct
Gogo.opentelemetry.io/otelv1.44.0direct
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.44.0direct
Gogo.opentelemetry.io/otel/sdkv1.44.0direct
Gogo.opentelemetry.io/otel/tracev1.44.0direct
Gogolang.org/x/cryptov0.53.0direct
Gogolang.org/x/sysv0.47.0direct
Gogolang.org/x/termv0.44.0direct
Gogopkg.in/yaml.v3v3.0.1direct
npmreact19.2.7direct
npmreact-dom19.2.7direct
Gocel.dev/exprv0.25.2indirect
Gocloud.google.com/gov0.123.0indirect
Gocloud.google.com/go/authv0.20.0indirect
Gocloud.google.com/go/auth/oauth2adaptv0.2.8indirect
Gocloud.google.com/go/compute/metadatav0.9.0indirect
Gocloud.google.com/go/iamv1.11.0indirect
Gocloud.google.com/go/kmsv1.31.0indirect
Gocloud.google.com/go/longrunningv1.1.0indirect
Gocloud.google.com/go/monitoringv1.29.0indirect
Gocloud.google.com/go/storagev1.63.0indirect
Gocode.gitea.io/sdk/giteav0.23.2indirect
Godario.cat/mergov1.0.2indirect
Gofilippo.io/agev1.3.1indirect
Gofilippo.io/edwards25519v1.2.0indirect
Gofilippo.io/hpkev0.4.0indirect
Gogithub.com/42wim/httpsigv1.2.4indirect
Gogithub.com/aws/aws-sdk-go-v2v1.42.0indirect
Gogithub.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.13indirect
Gogithub.com/aws/aws-sdk-go-v2/configv1.32.25indirect
Gogithub.com/aws/aws-sdk-go-v2/credentialsv1.19.24indirect
Gogithub.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.29indirect
Gogithub.com/aws/aws-sdk-go-v2/feature/s3/managerv1.22.28indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.29indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.29indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/v4av1.4.30indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.12indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/checksumv1.9.22indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.29indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/s3sharedv1.19.29indirect
Gogithub.com/aws/aws-sdk-go-v2/service/kmsv1.53.4indirect
Gogithub.com/aws/aws-sdk-go-v2/service/s3v1.104.0indirect
Gogithub.com/aws/aws-sdk-go-v2/service/signinv1.2.0indirect
Gogithub.com/aws/aws-sdk-go-v2/service/ssov1.31.3indirect
Gogithub.com/aws/aws-sdk-go-v2/service/ssooidcv1.36.6indirect
Gogithub.com/aws/aws-sdk-go-v2/service/stsv1.43.3indirect
Gogithub.com/aws/smithy-gov1.27.3indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/azcorev1.22.0indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/azidentityv1.14.0indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/internalv1.12.0indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/security/keyvault/azkeysv1.5.0indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/security/keyvault/internalv1.2.0indirect
Gogithub.com/azuread/microsoft-authentication-library-for-gov1.7.2indirect
Gogithub.com/beorn7/perksv1.0.1indirect
Gogithub.com/blang/semverv3.5.1+incompatibleindirect
Gogithub.com/buger/jsonparserv1.1.2indirect
Gogithub.com/cenkalti/backoff/v4v4.3.0indirect
Gogithub.com/cenkalti/backoff/v5v5.0.3indirect
Gogithub.com/cespare/xxhash/v2v2.3.0indirect
Gogithub.com/cloudflare/circlv1.6.4indirect
Gogithub.com/cncf/xds/gov0.0.0-20260202195803-dba9d589def2indirect
Gogithub.com/containerd/errdefsv1.0.0indirect
Gogithub.com/containerd/errdefs/pkgv0.3.0indirect
Gogithub.com/cpuguy83/go-md2man/v2v2.0.7indirect
Gogithub.com/cyphar/filepath-securejoinv0.6.1indirect
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccindirect
Gogithub.com/davidmz/go-pageantv1.0.2indirect
Gogithub.com/distribution/referencev0.6.0indirect
Gogithub.com/docker/go-connectionsv0.7.0indirect
Gogithub.com/docker/go-unitsv0.5.0indirect
Gogithub.com/emirpasic/godsv1.18.1indirect
Gogithub.com/envoyproxy/go-control-plane/envoyv1.37.0indirect
Gogithub.com/envoyproxy/protoc-gen-validatev1.3.3indirect
Gogithub.com/felixge/httpsnoopv1.1.0indirect
Gogithub.com/getsops/gopgagentv0.0.0-20241224165529-7044f28e491eindirect
Gogithub.com/go-fed/httpsigv1.1.0indirect
Gogithub.com/go-git/gcfgv1.5.1-0.20230307220236-3a3c6141e376indirect
Gogithub.com/go-git/go-billy/v5v5.9.0indirect
Gogithub.com/go-jose/go-jose/v4v4.1.4indirect
Gogithub.com/go-logr/logrv1.4.3indirect
Gogithub.com/go-logr/stdrv1.2.2indirect
Gogithub.com/go-viper/mapstructure/v2v2.5.0indirect
Gogithub.com/goccy/go-yamlv1.19.2indirect
Gogithub.com/golang-jwt/jwt/v5v5.3.1indirect
Gogithub.com/golang/groupcachev0.0.0-20241129210726-2c02b8208cf8indirect
Gogithub.com/google/go-cmpv0.7.0indirect
Gogithub.com/google/go-github/v86v86.0.0indirect
Gogithub.com/google/go-querystringv1.2.0indirect
Gogithub.com/google/s2a-gov0.1.9indirect
Gogithub.com/google/shlexv0.0.0-20191202100458-e7afc7fbc510indirect
Gogithub.com/googleapis/enterprise-certificate-proxyv0.3.17indirect
Gogithub.com/googleapis/gax-go/v2v2.22.0indirect
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcpv1.33.0indirect
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/exporter/metricv0.57.0indirect
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemappingv0.57.0indirect
Gogithub.com/goware/prefixerv0.0.0-20160118172347-395022866408indirect
Gogithub.com/grpc-ecosystem/grpc-gateway/v2v2.29.0indirect
Gogithub.com/hashicorp/errwrapv1.1.0indirect
Gogithub.com/hashicorp/go-cleanhttpv0.5.2indirect
Gogithub.com/hashicorp/go-multierrorv1.1.1indirect
Gogithub.com/hashicorp/go-retryablehttpv0.7.8indirect
Gogithub.com/hashicorp/go-rootcertsv1.0.2indirect
Gogithub.com/hashicorp/go-secure-stdlib/parseutilv0.2.0indirect
Gogithub.com/hashicorp/go-secure-stdlib/strutilv0.1.2indirect
Gogithub.com/hashicorp/go-sockaddrv1.0.7indirect
Gogithub.com/hashicorp/go-versionv1.9.0indirect
Gogithub.com/hashicorp/hclv1.0.1-vault-7indirect
Gogithub.com/hashicorp/vault/apiv1.23.0indirect
Gogithub.com/huandu/xstringsv1.5.0indirect
Gogithub.com/huaweicloud/huaweicloud-sdk-go-v3v0.1.202indirect
Gogithub.com/inconshreveable/mousetrapv1.1.0indirect
Gogithub.com/jbenet/go-contextv0.0.0-20150711004518-d14ea06fba99indirect
Gogithub.com/json-iterator/gov1.1.13-0.20220915233716-71ac16282d12indirect
Gogithub.com/kevinburke/ssh_configv1.2.0indirect
Gogithub.com/klauspost/cpuid/v2v2.3.0indirect
Gogithub.com/kylelemons/godebugv1.1.0indirect
Gogithub.com/lib/pqv1.12.3indirect
Gogithub.com/masterminds/goutilsv1.1.1indirect
Gogithub.com/masterminds/semver/v3v3.5.0indirect
Gogithub.com/mattn/go-colorablev0.1.15indirect
Gogithub.com/mattn/go-isattyv0.0.22indirect
Gogithub.com/microsoft/go-winiov0.6.2indirect
Gogithub.com/mitchellh/copystructurev1.2.0indirect
Gogithub.com/mitchellh/go-homedirv1.1.0indirect
Gogithub.com/mitchellh/go-wordwrapv1.0.1indirect
Gogithub.com/mitchellh/mapstructurev1.5.0indirect
Gogithub.com/mitchellh/reflectwalkv1.0.2indirect
Gogithub.com/moby/docker-image-specv1.3.1indirect
Gogithub.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1ddindirect
Gogithub.com/modern-go/reflect2v1.0.2indirect
Gogithub.com/munnerz/goautonegv0.0.0-20191010083416-a7dc8b61c822indirect
Gogithub.com/opencontainers/go-digestv1.0.0indirect
Gogithub.com/opencontainers/image-specv1.1.1indirect
Gogithub.com/pjbgf/sha1cdv0.6.0indirect
Gogithub.com/pkg/browserv0.0.0-20240102092130-5ac0b6a4141cindirect
Gogithub.com/pkg/errorsv0.9.1indirect
Gogithub.com/planetscale/vtprotobufv0.6.1-0.20240319094008-0393e58bdf10indirect
Gogithub.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2indirect
Gogithub.com/prometheus/client_modelv0.6.2indirect
Gogithub.com/prometheus/commonv0.66.1indirect
Gogithub.com/prometheus/procfsv0.16.1indirect
Gogithub.com/protonmail/go-cryptov1.4.1indirect
Gogithub.com/russross/blackfriday/v2v2.1.0indirect
Gogithub.com/ryanuber/go-globv1.0.0indirect
Gogithub.com/sergi/go-diffv1.3.2-0.20230802210424-5b0b94c5c0d3indirect
Gogithub.com/shopspring/decimalv1.4.0indirect
Gogithub.com/sirupsen/logrusv1.9.4indirect
Gogithub.com/skeema/knownhostsv1.3.1indirect
Gogithub.com/spf13/castv1.7.0indirect
Gogithub.com/spf13/pflagv1.0.9indirect
Gogithub.com/spiffe/go-spiffe/v2v2.8.1indirect
Gogithub.com/tjfoc/gmsmv1.4.1indirect
Gogithub.com/ulikunitz/xzv0.5.15indirect
Gogithub.com/urfave/cliv1.22.17indirect
Gogithub.com/xanzy/ssh-agentv0.3.3indirect
Gogitlab.com/gitlab-org/api/client-gov1.46.0indirect
Gogo.mongodb.org/mongo-driverv1.17.9indirect
Gogo.opentelemetry.io/auto/sdkv1.2.1indirect
Gogo.opentelemetry.io/contrib/detectors/gcpv1.44.0indirect
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.69.0indirect
Gogo.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.69.0indirect
Gogo.opentelemetry.io/otel/exporters/otlp/otlptracev1.44.0indirect
Gogo.opentelemetry.io/otel/metricv1.44.0indirect
Gogo.opentelemetry.io/otel/sdk/metricv1.44.0indirect
Gogo.opentelemetry.io/proto/otlpv1.10.0indirect
Gogo.yaml.in/yaml/v2v2.4.2indirect
Gogo.yaml.in/yaml/v3v3.0.4indirect
Gogolang.org/x/netv0.56.0indirect
Gogolang.org/x/oauth2v0.36.0indirect
Gogolang.org/x/syncv0.21.0indirect
Gogolang.org/x/textv0.38.0indirect
Gogolang.org/x/timev0.15.0indirect
Gogoogle.golang.org/apiv0.286.0indirect
Gogoogle.golang.org/genprotov0.0.0-20260622175928-b703f567277dindirect
Gogoogle.golang.org/genproto/googleapis/apiv0.0.0-20260622175928-b703f567277dindirect
Gogoogle.golang.org/genproto/googleapis/rpcv0.0.0-20260622175928-b703f567277dindirect
Gogoogle.golang.org/grpcv1.81.1indirect
Gogoogle.golang.org/protobufv1.36.11indirect
Gogopkg.in/ini.v1v1.67.3indirect
Gogopkg.in/warnings.v0v0.1.2indirect
npm@babel/code-frame7.27.1indirect
npm@babel/compat-data7.28.5indirect
npm@babel/core7.28.5indirect
npm@babel/generator7.28.5indirect
npm@babel/helper-compilation-targets7.27.2indirect
npm@babel/helper-globals7.28.0indirect
npm@babel/helper-module-imports7.27.1indirect
npm@babel/helper-module-transforms7.28.3indirect
npm@babel/helper-string-parser7.27.1indirect
npm@babel/helper-validator-identifier7.28.5indirect
npm@babel/helper-validator-option7.27.1indirect
npm@babel/helpers7.28.4indirect
npm@babel/parser7.28.5indirect
npm@babel/template7.27.2indirect
npm@babel/traverse7.28.5indirect
npm@babel/types7.28.5indirect
npm@emnapi/core1.11.1indirect
npm@emnapi/runtime1.11.1indirect
npm@emnapi/wasi-threads1.2.2indirect
npm@eslint-community/eslint-utils4.9.1indirect
npm@eslint-community/regexpp4.12.2indirect
npm@eslint/config-array0.21.1indirect
npm@eslint/config-helpers0.4.2indirect
npm@eslint/core0.17.0indirect
npm@eslint/eslintrc3.3.3indirect
npm@eslint/js9.39.2indirect
npm@eslint/object-schema2.1.7indirect
npm@eslint/plugin-kit0.4.1indirect
npm@humanfs/core0.19.1indirect
npm@humanfs/node0.16.7indirect
npm@humanwhocodes/module-importer1.0.1indirect
npm@humanwhocodes/retry0.4.3indirect
npm@jridgewell/gen-mapping0.3.13indirect
npm@jridgewell/remapping2.3.5indirect
npm@jridgewell/resolve-uri3.1.2indirect
npm@jridgewell/sourcemap-codec1.5.5indirect
npm@jridgewell/trace-mapping0.3.31indirect
npm@napi-rs/wasm-runtime1.1.4indirect
npm@napi-rs/wasm-runtime1.1.6indirect
npm@oxc-project/types0.139.0indirect
npm@rolldown/binding-android-arm641.1.5indirect
npm@rolldown/binding-darwin-arm641.1.5indirect
npm@rolldown/binding-darwin-x641.1.5indirect
npm@rolldown/binding-freebsd-x641.1.5indirect
npm@rolldown/binding-linux-arm-gnueabihf1.1.5indirect
npm@rolldown/binding-linux-arm64-gnu1.1.5indirect
npm@rolldown/binding-linux-arm64-musl1.1.5indirect
npm@rolldown/binding-linux-ppc64-gnu1.1.5indirect
npm@rolldown/binding-linux-s390x-gnu1.1.5indirect
npm@rolldown/binding-linux-x64-gnu1.1.5indirect
npm@rolldown/binding-linux-x64-musl1.1.5indirect
npm@rolldown/binding-openharmony-arm641.1.5indirect
npm@rolldown/binding-wasm32-wasi1.1.5indirect
npm@rolldown/binding-win32-arm64-msvc1.1.5indirect
npm@rolldown/binding-win32-x64-msvc1.1.5indirect
npm@rolldown/pluginutils1.0.1indirect
npm@tailwindcss/node4.3.3indirect
npm@tailwindcss/oxide4.3.3indirect
npm@tailwindcss/oxide-android-arm644.3.3indirect
npm@tailwindcss/oxide-darwin-arm644.3.3indirect
npm@tailwindcss/oxide-darwin-x644.3.3indirect
npm@tailwindcss/oxide-freebsd-x644.3.3indirect
npm@tailwindcss/oxide-linux-arm-gnueabihf4.3.3indirect
npm@tailwindcss/oxide-linux-arm64-gnu4.3.3indirect
npm@tailwindcss/oxide-linux-arm64-musl4.3.3indirect
npm@tailwindcss/oxide-linux-x64-gnu4.3.3indirect
npm@tailwindcss/oxide-linux-x64-musl4.3.3indirect
npm@tailwindcss/oxide-wasm32-wasi4.3.3indirect
npm@tailwindcss/oxide-win32-arm64-msvc4.3.3indirect
npm@tailwindcss/oxide-win32-x64-msvc4.3.3indirect
npm@tailwindcss/vite4.3.3indirect
npm@tybys/wasm-util0.10.2indirect
npm@tybys/wasm-util0.10.3indirect
npm@types/estree1.0.8indirect
npm@types/json-schema7.0.15indirect
npm@types/node26.1.1indirect
npm@types/react19.2.17indirect
npm@types/react-dom19.2.3indirect
npm@typescript-eslint/eslint-plugin8.64.0indirect
npm@typescript-eslint/parser8.64.0indirect
npm@typescript-eslint/project-service8.64.0indirect
npm@typescript-eslint/scope-manager8.64.0indirect
npm@typescript-eslint/tsconfig-utils8.64.0indirect
npm@typescript-eslint/type-utils8.64.0indirect
npm@typescript-eslint/types8.64.0indirect
npm@typescript-eslint/typescript-estree8.64.0indirect
npm@typescript-eslint/utils8.64.0indirect
npm@typescript-eslint/visitor-keys8.64.0indirect
npm@vitejs/plugin-react6.0.3indirect
npmacorn8.15.0indirect
npmacorn-jsx5.3.2indirect
npmajv6.15.0indirect
npmansi-styles4.3.0indirect
npmargparse2.0.1indirect
npmbalanced-match1.0.2indirect
npmbalanced-match4.0.4indirect
npmbaseline-browser-mapping2.9.11indirect
npmbeautiful-mermaid1.1.3indirect
npmbrace-expansion1.1.15indirect
npmbrace-expansion5.0.7indirect
npmbrowserslist4.28.1indirect
npmcallsites3.1.0indirect
npmcaniuse-lite1.0.30001762indirect
npmchalk4.1.2indirect
npmcolor-convert2.0.1indirect
npmcolor-name1.1.4indirect
npmconcat-map0.0.1indirect
npmconvert-source-map2.0.0indirect
npmcross-spawn7.0.6indirect
npmcsstype3.2.3indirect
npmdebug4.4.3indirect
npmdeep-is0.1.4indirect
npmdetect-libc2.1.2indirect
npmelectron-to-chromium1.5.267indirect
npmelkjs0.11.0indirect
npmenhanced-resolve5.24.2indirect
npmentities7.0.1indirect
npmescalade3.2.0indirect
npmescape-string-regexp4.0.0indirect
npmeslint9.39.2indirect
npmeslint-plugin-react-hooks7.1.1indirect
npmeslint-plugin-react-refresh0.5.3indirect
npmeslint-scope8.4.0indirect
npmeslint-visitor-keys3.4.3indirect
npmeslint-visitor-keys4.2.1indirect
npmeslint-visitor-keys5.0.1indirect
npmespree10.4.0indirect
npmesquery1.7.0indirect
npmesrecurse4.3.0indirect
npmestraverse5.3.0indirect
npmesutils2.0.3indirect
npmfast-deep-equal3.1.3indirect
npmfast-json-stable-stringify2.1.0indirect
npmfast-levenshtein2.0.6indirect
npmfdir6.5.0indirect
npmfile-entry-cache8.0.0indirect
npmfind-up5.0.0indirect
npmflat-cache4.0.1indirect
npmflatted3.4.2indirect
npmfsevents2.3.3indirect
npmgensync1.0.0-beta.2indirect
npmglob-parent6.0.2indirect
npmglobals14.0.0indirect
npmglobals17.7.0indirect
npmgraceful-fs4.2.11indirect
npmhas-flag4.0.0indirect
npmhermes-estree0.25.1indirect
npmhermes-parser0.25.1indirect
npmignore5.3.2indirect
npmignore7.0.6indirect
npmimport-fresh3.3.1indirect
npmimurmurhash0.1.4indirect
npmis-extglob2.1.1indirect
npmis-glob4.0.3indirect
npmisexe2.0.0indirect
npmjiti2.7.0indirect
npmjs-tokens4.0.0indirect
npmjs-yaml4.3.0indirect
npmjsesc3.1.0indirect
npmjson-buffer3.0.1indirect
npmjson-schema-traverse0.4.1indirect
npmjson-stable-stringify-without-jsonify1.0.1indirect
npmjson52.2.3indirect
npmkeyv4.5.4indirect
npmlevn0.4.1indirect
npmlightningcss1.32.0indirect
npmlightningcss-android-arm641.32.0indirect
npmlightningcss-darwin-arm641.32.0indirect
npmlightningcss-darwin-x641.32.0indirect
npmlightningcss-freebsd-x641.32.0indirect
npmlightningcss-linux-arm-gnueabihf1.32.0indirect
npmlightningcss-linux-arm64-gnu1.32.0indirect
npmlightningcss-linux-arm64-musl1.32.0indirect
npmlightningcss-linux-x64-gnu1.32.0indirect
npmlightningcss-linux-x64-musl1.32.0indirect
npmlightningcss-win32-arm64-msvc1.32.0indirect
npmlightningcss-win32-x64-msvc1.32.0indirect
npmlocate-path6.0.0indirect
npmlodash.merge4.6.2indirect
npmlru-cache5.1.1indirect
npmmagic-string0.30.21indirect
npmminimatch10.2.5indirect
npmminimatch3.1.5indirect
npmms2.1.3indirect
npmnanoid3.3.16indirect
npmnatural-compare1.4.0indirect
npmnode-releases2.0.27indirect
npmoptionator0.9.4indirect
npmp-limit3.1.0indirect
npmp-locate5.0.0indirect
npmparent-module1.0.1indirect
npmpath-exists4.0.0indirect
npmpath-key3.1.1indirect
npmpicocolors1.1.1indirect
npmpicomatch4.0.5indirect
npmpostcss8.5.19indirect
npmprelude-ls1.2.1indirect
npmpunycode2.3.1indirect
npmresolve-from4.0.0indirect
npmrolldown1.1.5indirect
npmscheduler0.27.0indirect
npmsemver6.3.1indirect
npmsemver7.8.5indirect
npmshebang-command2.0.0indirect
npmshebang-regex3.0.0indirect
npmsource-map-js1.2.1indirect
npmstrip-json-comments3.1.1indirect
npmsupports-color7.2.0indirect
npmtailwindcss4.3.3indirect
npmtapable2.3.3indirect
npmtinyglobby0.2.17indirect
npmts-api-utils2.5.0indirect
npmtslib2.8.1indirect
npmtype-check0.4.0indirect
npmtypescript5.9.3indirect
npmtypescript-eslint8.64.0indirect
npmundici-types8.3.0indirect
npmupdate-browserslist-db1.2.3indirect
npmuri-js4.4.1indirect
npmvite8.1.5indirect
npmwhich2.0.2indirect
npmword-wrap1.2.5indirect
npmyallist3.1.1indirect
npmyocto-queue0.1.0indirect
npmzod4.3.5indirect
npmzod-validation-error4.0.2indirect
Dependency advisories 5

This repository publishes no package the index resolves, so its own dependency graph was assessed — 421 packages, which also include development and test pins that never ship: 5 carry known advisories, of which 1 are direct.

PackageVersionRelationSeverityAdvisoriesFixed in
google.golang.org/grpcv1.81.1indirectcritical11.82.1
brace-expansion1.1.15indirecthigh15.0.7
@babel/core7.28.5indirectlow18.0.0-rc.6
golang.org/x/cryptov0.53.0directunknown1—
golang.org/x/textv0.38.0indirectunknown10.39.0

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable
{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 10129,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 2745380,
        "CSS": 26406,
        "HTML": 655,
        "Shell": 5253,
        "Makefile": 5760,
        "Dockerfile": 4322,
        "JavaScript": 3112,
        "TypeScript": 47504
      },
      "pushed_at": "2026-07-20T22:58:15Z",
      "created_at": "2025-12-22T00:50:45Z",
      "owner_type": "User",
      "updated_at": "2026-07-20T22:58:20Z",
      "description": "GitOps for Docker Compose on bare metal",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://linkedin.com/in/cameronsjo",
      "name": "Cameron Sjo",
      "type": "User",
      "login": "cameronsjo",
      "company": null,
      "location": "Bentonville, AR",
      "followers": 16,
      "avatar_url": "https://avatars.githubusercontent.com/u/4084915?v=4",
      "created_at": "2013-04-07T14:57:02Z",
      "is_verified": null,
      "public_repos": 73,
      "account_age_days": 4856
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.39.3",
          "kind": "patch",
          "published_at": "2026-07-19T22:18:42Z"
        },
        {
          "tag": "v0.39.2",
          "kind": "patch",
          "published_at": "2026-07-19T21:33:01Z"
        },
        {
          "tag": "v0.39.1",
          "kind": "patch",
          "published_at": "2026-07-19T20:46:51Z"
        },
        {
          "tag": "v0.39.0",
          "kind": "minor",
          "published_at": "2026-07-19T19:24:05Z"
        },
        {
          "tag": "v0.38.5",
          "kind": "patch",
          "published_at": "2026-07-19T17:41:16Z"
        },
        {
          "tag": "v0.38.4",
          "kind": "patch",
          "published_at": "2026-07-18T21:08:26Z"
        },
        {
          "tag": "v0.38.3",
          "kind": "patch",
          "published_at": "2026-07-18T17:23:15Z"
        },
        {
          "tag": "v0.38.2",
          "kind": "patch",
          "published_at": "2026-07-18T00:39:14Z"
        },
        {
          "tag": "v0.38.1",
          "kind": "patch",
          "published_at": "2026-07-18T00:34:38Z"
        },
        {
          "tag": "v0.38.0",
          "kind": "minor",
          "published_at": "2026-07-17T23:38:44Z"
        },
        {
          "tag": "v0.37.10",
          "kind": "patch",
          "published_at": "2026-07-02T22:10:50Z"
        },
        {
          "tag": "v0.37.9",
          "kind": "patch",
          "published_at": "2026-07-02T21:58:05Z"
        },
        {
          "tag": "v0.37.8",
          "kind": "patch",
          "published_at": "2026-07-02T21:50:31Z"
        },
        {
          "tag": "v0.37.7",
          "kind": "patch",
          "published_at": "2026-07-02T21:46:39Z"
        },
        {
          "tag": "v0.37.6",
          "kind": "patch",
          "published_at": "2026-07-02T21:42:18Z"
        },
        {
          "tag": "v0.37.5",
          "kind": "patch",
          "published_at": "2026-05-28T20:39:45Z"
        },
        {
          "tag": "v0.37.4",
          "kind": "patch",
          "published_at": "2026-05-28T15:59:23Z"
        },
        {
          "tag": "v0.37.3",
          "kind": "patch",
          "published_at": "2026-05-28T13:33:27Z"
        },
        {
          "tag": "v0.37.2",
          "kind": "patch",
          "published_at": "2026-05-28T12:52:08Z"
        },
        {
          "tag": "v0.37.1",
          "kind": "patch",
          "published_at": "2026-05-26T23:58:11Z"
        },
        {
          "tag": "v0.37.0",
          "kind": "minor",
          "published_at": "2026-05-25T17:27:07Z"
        },
        {
          "tag": "v0.36.0",
          "kind": "minor",
          "published_at": "2026-05-25T16:40:38Z"
        },
        {
          "tag": "v0.35.1",
          "kind": "patch",
          "published_at": "2026-05-25T16:00:32Z"
        },
        {
          "tag": "v0.35.0",
          "kind": "minor",
          "published_at": "2026-05-22T00:07:03Z"
        },
        {
          "tag": "v0.34.3",
          "kind": "patch",
          "published_at": "2026-05-20T00:30:59Z"
        },
        {
          "tag": "v0.34.2",
          "kind": "patch",
          "published_at": "2026-05-20T00:29:08Z"
        },
        {
          "tag": "v0.34.1",
          "kind": "patch",
          "published_at": "2026-05-20T00:23:50Z"
        },
        {
          "tag": "v0.34.0",
          "kind": "minor",
          "published_at": "2026-05-18T00:49:20Z"
        },
        {
          "tag": "v0.33.3",
          "kind": "patch",
          "published_at": "2026-04-05T19:14:23Z"
        },
        {
          "tag": "v0.33.2",
          "kind": "patch",
          "published_at": "2026-04-05T14:34:21Z"
        },
        {
          "tag": "v0.33.1",
          "kind": "patch",
          "published_at": "2026-03-26T18:15:56Z"
        },
        {
          "tag": "v0.33.0",
          "kind": "minor",
          "published_at": "2026-03-25T21:30:12Z"
        },
        {
          "tag": "v0.32.6",
          "kind": "patch",
          "published_at": "2026-03-24T14:50:55Z"
        },
        {
          "tag": "v0.32.5",
          "kind": "patch",
          "published_at": "2026-03-24T13:19:24Z"
        },
        {
          "tag": "v0.32.4",
          "kind": "patch",
          "published_at": "2026-03-23T23:32:47Z"
        },
        {
          "tag": "v0.32.3",
          "kind": "patch",
          "published_at": "2026-03-23T23:04:18Z"
        },
        {
          "tag": "v0.32.2",
          "kind": "patch",
          "published_at": "2026-03-23T01:48:43Z"
        },
        {
          "tag": "v0.32.1",
          "kind": "patch",
          "published_at": "2026-03-22T22:36:05Z"
        },
        {
          "tag": "v0.32.0",
          "kind": "minor",
          "published_at": "2026-03-21T23:01:46Z"
        },
        {
          "tag": "v0.31.0",
          "kind": "minor",
          "published_at": "2026-03-21T22:26:29Z"
        },
        {
          "tag": "v0.30.4",
          "kind": "patch",
          "published_at": "2026-03-21T21:13:04Z"
        },
        {
          "tag": "v0.30.3",
          "kind": "patch",
          "published_at": "2026-03-21T21:11:01Z"
        },
        {
          "tag": "v0.30.2",
          "kind": "patch",
          "published_at": "2026-03-21T03:53:01Z"
        },
        {
          "tag": "v0.30.1",
          "kind": "patch",
          "published_at": "2026-03-21T02:50:27Z"
        },
        {
          "tag": "v0.30.0",
          "kind": "minor",
          "published_at": "2026-03-20T23:32:15Z"
        },
        {
          "tag": "v0.29.2",
          "kind": "patch",
          "published_at": "2026-03-18T00:26:39Z"
        },
        {
          "tag": "v0.29.1",
          "kind": "patch",
          "published_at": "2026-03-17T01:44:57Z"
        },
        {
          "tag": "v0.29.0",
          "kind": "minor",
          "published_at": "2026-03-16T22:32:50Z"
        },
        {
          "tag": "v0.28.0",
          "kind": "minor",
          "published_at": "2026-03-16T18:34:41Z"
        },
        {
          "tag": "v0.27.0",
          "kind": "minor",
          "published_at": "2026-03-14T14:42:44Z"
        },
        {
          "tag": "v0.26.0",
          "kind": "minor",
          "published_at": "2026-03-13T22:39:03Z"
        },
        {
          "tag": "v0.25.1",
          "kind": "patch",
          "published_at": "2026-03-13T19:54:41Z"
        },
        {
          "tag": "v0.25.0",
          "kind": "minor",
          "published_at": "2026-03-13T19:10:19Z"
        },
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2026-03-13T19:09:14Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2026-03-13T18:59:09Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2026-03-13T18:54:54Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2026-03-13T18:40:49Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2026-03-13T15:59:23Z"
        },
        {
          "tag": "v0.18.1",
          "kind": "patch",
          "published_at": "2026-03-08T04:00:25Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2026-03-08T03:09:17Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2026-03-07T01:49:51Z"
        },
        {
          "tag": "v0.16.2",
          "kind": "patch",
          "published_at": "2026-03-07T01:42:26Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2026-03-02T02:42:49Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2026-02-28T20:53:12Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2026-02-28T14:36:38Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-02-26T02:51:14Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-02-25T17:53:31Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-02-23T23:39:45Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2026-02-23T20:41:31Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-02-23T19:12:57Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-02-23T18:47:09Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-02-23T18:11:41Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-02-23T17:42:57Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-02-23T00:03:10Z"
        },
        {
          "tag": "v0.7.3",
          "kind": "patch",
          "published_at": "2026-02-22T23:12:39Z"
        },
        {
          "tag": "v0.7.2",
          "kind": "patch",
          "published_at": "2026-02-22T21:52:32Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2026-02-22T18:36:11Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-02-22T18:19:23Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2026-02-22T18:11:59Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-02-22T00:13:47Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-02-21T22:31:08Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-02-15T15:22:24Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-02-14T04:08:53Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-02-14T04:06:06Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-02-14T02:52:29Z"
        },
        {
          "tag": "v0.2.10",
          "kind": "patch",
          "published_at": "2026-01-30T04:27:55Z"
        },
        {
          "tag": "v0.2.9",
          "kind": "patch",
          "published_at": "2026-01-02T20:26:36Z"
        },
        {
          "tag": "v0.2.8",
          "kind": "patch",
          "published_at": "2026-01-02T18:06:45Z"
        },
        {
          "tag": "v0.2.7",
          "kind": "patch",
          "published_at": "2026-01-02T01:23:25Z"
        },
        {
          "tag": "v0.2.6",
          "kind": "patch",
          "published_at": "2025-12-26T01:55:10Z"
        },
        {
          "tag": "v0.2.5",
          "kind": "patch",
          "published_at": "2025-12-24T03:33:19Z"
        },
        {
          "tag": "v0.2.4",
          "kind": "patch",
          "published_at": "2025-12-24T01:18:31Z"
        },
        {
          "tag": "v0.2.3",
          "kind": "patch",
          "published_at": "2025-12-24T00:45:17Z"
        },
        {
          "tag": "v0.2.2",
          "kind": "patch",
          "published_at": "2025-12-24T00:37:05Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2025-12-23T06:02:51Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "26cb1b561d0c97ae8c616c2ba18c21ef26bea7f2",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: gitignore .claude/skill-red/ capture artifacts",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-20T22:58:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "413d1e47efeb28b0416acfd0959b1de99b458f1e",
          "body": "chore(main): release 0.39.3",
          "is_bot": true,
          "headline": "Merge pull request #464 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-19T22:18:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ffd35959856d37184f6b526aa6d1e8248383719a",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.39.3",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T22:18:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1f3a4cf00dd9fd2ebc1bdb397cc18565e015aee0",
          "body": "…s auth (#294, #295, #296)\n\nCloses #294, #295, #296. #294: include/fromJsonFile confined to a <infraDir>/templates subtree allowlist (configurable via template_include_dir; breaking for includes outside templates/) — replaces the bypassable whole-infra-root denylist. #295: trigger bodies capped at 6\n[…]\nout, constant-time compare; the control bearer never has to be shared with scrapers. Threaded through daemon + reconcile CLI. Follow-ups: #462 (/health info surface), #463 (bosun render include path).",
          "is_bot": false,
          "headline": "fix: template include allowlist, trigger body cap, fail-closed metric…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-19T22:18:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "18117b8867bca3437420af17bb6fbf5ed14ec909",
          "body": "chore(main): release 0.39.2",
          "is_bot": true,
          "headline": "Merge pull request #460 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-19T21:32:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c2180c509c1f5813165bdf09572dd2615b9f48a",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.39.2",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T21:32:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1636248664595b8cd4aee9422e867c76b6260e91",
          "body": "… backups (#360, #353)\n\nCloses #360, #353. #360: a content-free footprint (fresh host) no longer yields a fake 'Backup saved' anchor — Backup() returns an empty name, the caller records no anchor (lastBackupPath empty, lastBackupIsFresh false), deploy proceeds. #353: CleanupBackups now classifies ea\n[…]\nsame VerifyBackup used for anchor selection (not a cheap existence check), so corrupt/truncated dirs never occupy a retention slot and can't evict a good backup; ctx threaded through for cancellation.",
          "is_bot": false,
          "headline": "fix: content-free backup is not a rollback anchor; retention verifies…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-19T21:32:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f92d6f740520bb23bce014b29d0fe6ce0dd98707",
          "body": "chore(main): release 0.39.1",
          "is_bot": true,
          "headline": "Merge pull request #457 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-19T20:46:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "30ac93d85c81d03eadb3c1879a0f9080d89e4716",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.39.1",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T20:46:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3473459bbb9462d3ba560e84c09722600f23c35f",
          "body": "Closes #445. Widens rollback from compose-files-only to the full managed tree via a RollbackSet chokepoint (restore-set from ManagedFiles). Order: restore files → opt-in delete-missing → compose-up last; per-file errors.Join. DeleteMissing defaults false; when true, gated on a tracked lastBackupIsFr\n[…]\nack anchor never deletes. withinAppdata containment guard confines every restore/delete to the appdata subtree. Rollback trigger stays compose-driven, preserving the #392 appdata-only-runs-hooks case.",
          "is_bot": false,
          "headline": "fix: full managed-tree rollback via RollbackSet chokepoint (#445)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-19T20:46:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "af74a93f7be1465802efbdf394ed1e19cafcd1bc",
          "body": "chore(main): release 0.39.0",
          "is_bot": true,
          "headline": "Merge pull request #455 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-19T19:23:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c9460cbd1eef168c4d487a514581b454b1b5088",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.39.0",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T19:23:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa0272fdfc4dba434c25e63ecd4c1a83cfec23d3",
          "body": "…ed-service rollback (#339)\n\nCloses #339. Adds health_gate_scope config: critical (default, byte-for-byte no-op), declared (rollback on any declared-service health failure with the #392 pre-existing-casualty exemption), off. Declared-scope failures emit a throttled failure+rollback alert pair on the 1/3/10/30 ShouldAlert cadence; critical emits no rollback alert. Deletes dead ComposeUpWithRollback/ComposeUpMultipleWithRollback. Ships openspec change dir add-health-gate-scope.",
          "is_bot": false,
          "headline": "feat: three-way health_gate_scope (critical|declared|off) with declar…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-19T19:23:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c54f051d04623318b99778d6ff27543b9d01fd01",
          "body": "…d (#336)\n\nCloses #336. Reorders the local reconcile pipeline tail to [hooks → verifyPostDeploy (local-gated) → success-save] so an unhealthy local deploy is recorded as a failure — breaker counts it, throttled failure alert fires (previously suppressed by AttemptCount=0), next cycle retries. Remote deploys skip the local-socket verify and keep prior save semantics.",
          "is_bot": false,
          "headline": "fix: record deploy success only after health verification, local-gate…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-19T18:18:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3740b268af0d9bd3df7bfbc040223f07a272fd7",
          "body": "chore(main): release 0.38.5",
          "is_bot": true,
          "headline": "Merge pull request #451 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-19T17:41:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03aae5d3c1cb7d588756ba33ff7886aa32d78079",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.38.5",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T17:40:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8bdc2632d8b2a68bd06b0ffc2b1bc6b214811951",
          "body": "…quote ssh argv (#334, #340, #437)\n\nCloses #334, #340, #437. SHA-256 transfer-integrity gate before promoting staged remote trees to live (retryable, fresh tmpDir per attempt, graceful skip when remote lacks sha256sum), *DeployResult threaded through deployRemote, RollbackRemoteCompose with in-process safe archive extraction (link-target validated), validateHost before the new ssh probe, and shellquote.Join on all remote argv.",
          "is_bot": false,
          "headline": "fix: verify remote transfers before promotion, wire remote rollback, …",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-19T17:40:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fdc3fb0a6b6702206a47182f92291dc4dc44d920",
          "body": "Bumps [globals](https://github.com/sindresorhus/globals) from 16.5.0 to 17.7.0.\n- [Release notes](https://github.com/sindresorhus/globals/releases)\n- [Commits](https://github.com/sindresorhus/globals/compare/v16.5.0...v17.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: globals\n  dependency-versio\n[…]\nrect:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps-dev): bump globals from 16.5.0 to 17.7.0 in /webui (#382)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T16:47:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bf1efa822e0a54b48af6d14405a06553617ec23e",
          "body": "…383)\n\nBumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.10.4 to 26.1.1.\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)\n\n---\nupda\n[…]\nrect:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps-dev): bump @types/node from 24.10.4 to 26.1.1 in /webui (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T16:42:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "de3362181f39b47bd449f51c9fb2d08d393bf80b",
          "body": "Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2 to 4.\n- [Release notes](https://github.com/actions/attest-build-provenance/releases)\n- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)\n- [Commits](https://github.co\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/attest-build-provenance from 2 to 4 (#388)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T16:37:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "399fb07158deb05ba83f3c1370589ea680f28701",
          "body": "Bumps the gha-minor-patch group with 1 update in the / directory: [dagger/dagger-for-github](https://github.com/dagger/dagger-for-github).\n\n\nUpdates `dagger/dagger-for-github` from 8.2.0 to 8.4.1\n- [Release notes](https://github.com/dagger/dagger-for-github/releases)\n- [Commits](https://github.com/d\n[…]\nion-update:semver-minor\n  dependency-group: gha-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump dagger/dagger-for-github (#385)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T16:37:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f3b1ca0f2370fb4807ff8a427feb52af449710bc",
          "body": "chore(main): release 0.38.4",
          "is_bot": true,
          "headline": "Merge pull request #446 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-18T21:08:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2605976bab4ab7d04514d788147650d3731c8092",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.38.4",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-18T21:08:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "270fb2a84ee292527b78c04a3001f51fe28eca00",
          "body": "…very (#444)\n\n* fix: reject non-positive BOSUN_RECONCILE_TIMEOUT, fall back to 10m default\n\ncontext.WithTimeout(ctx, 0) yields an already-expired context, so a\nmisconfigured ReconcileTimeout=0 made every reconcile fail instantly.\nMirror the existing BOSUN_BACKUP_TIMEOUT validation: a non-positive or\n[…]\nmptCount\nand LastAttemptedCommit and saves state on that confirmed-skip path.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: reconcile timeout guard, health-gate baseline, daemon panic reco…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T21:07:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9e701b8b8921265e19e790038b3b4767665abb92",
          "body": "* chore(beads): capture final tracker state before retirement\n\n49 issues + 15 memories. Live issues migrated to GitHub (#431-#438);\nbosun-cdy/bosun-ixv verified done; bosun-hf9 already tracked as #165.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n* chore: retire beads issue tracker\n\nLive\n[…]\n.md now points at GitHub\nissues and drops bd from the session-close workflow.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: retire beads issue tracker (#440)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T17:40:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8a24f382dd6394cfad24fab9f62f68fb981cc90e",
          "body": "chore(main): release 0.38.3",
          "is_bot": true,
          "headline": "Merge pull request #441 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-18T17:23:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9510799d9c0eecfb52679adc16b7989eaf863665",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.38.3",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-18T17:22:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70596d75f0007968a250086a50fdc79db21a8028",
          "body": "…n error (#439)\n\nThe local Backup() shelled out to `tar --null -T -`, but the container image\nships busybox tar, which does not support --null: tar exited 1 before writing\na byte, and the discarded exit code hid it. Every pre-deploy backup ever taken\nwas an empty directory, and once the rollback-anc\n[…]\nded,\ngrowth truncated+logged), with an os.SameFile TOCTOU guard on opened files and\nabsolute-coordinate self-exclusion.\n\nCloses #395\nCloses #352\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): write local backups with native Go tar; fail loudly o…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T17:22:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4ea8331e35d785fc1cea6fc46f9e7de2cd8da09d",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(beads): record campaign session interactions",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T00:55:19Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ef7041c2d71cc8e23fbab82812753ec2482456f8",
          "body": "…ker (#428)\n\n* refactor: port internal/docker to moby split modules (stage 1)\n\nReplace the end-of-line github.com/docker/docker SDK with the stable moby\nsplit modules (github.com/moby/moby/api v1.55.0 + github.com/moby/moby/client\nv0.5.0) across the production build. Test files still reference the o\n[…]\n@anthropic.com>\n\n* refactor: use client.New over deprecated NewClientWithOpts\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: port internal/docker to moby split modules, drop docker/doc…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T00:52:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5d0d34a98e9e0375f66b11112c37fb160ede7ce1",
          "body": "chore(main): release 0.38.2",
          "is_bot": true,
          "headline": "Merge pull request #430 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-18T00:39:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a095f3874f97961a499eaad9abbc642c7ecfc6e3",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.38.2",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-18T00:38:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0d3a5cfeb9992c92e4744947a59bdba684be332",
          "body": "…er recovery (#427)\n\n* fix: gate daemon readiness on a successful initial reconcile\n\nThe initial-reconcile goroutine logged TriggerReconcile's error but then\ncalled setReady(true) unconditionally, so /ready reported healthy even\nafter the daemon's very first reconcile failed outright. Return before\n\n[…]\nt the daemon actually sets on that path.\n\nFollow-up to #350, per code review.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: daemon resilience batch — readiness gate, self-heal force, break…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T00:38:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "99389c2b2f359c7244db2cbd782c86a3c478bccc",
          "body": "chore(main): release 0.38.1",
          "is_bot": true,
          "headline": "Merge pull request #429 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-18T00:34:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78ecdbf4e0ca767b67d54b0f231e321a7c917313",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.38.1",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-18T00:34:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "38f5b6a09c468de4682599ee2e126dc5e2fd7562",
          "body": "* fix: honor SSH host-key policy on deploy path\n\nThe exec'd ssh/scp deploy/sync/mkdir calls ran with no host-key\noptions, so BOSUN_SSH_KNOWN_HOSTS / BOSUN_SSH_INSECURE_HOST_KEY were\nsilently ignored for deploy (only the go-git clone/pull path honored\nthem). In a daemon with an empty system known_hos\n[…]\nnt\n  survives, so the tests fail if the `ssh rm -f <tmp>` cleanup is removed.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: honor SSH host-key policy on deploy path (#426)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-18T00:33:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "be69dc75ab2a45e2d6c6a235f8b7096ed435c099",
          "body": "… with 10 updates (#400)\n\nBumps the webui-deps-minor-patch group with 9 updates in the /webui directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.3` | `19.2.7` |\n| [@types/react](https://github.com/DefinitelyTyped/Defi\n[…]\nate:semver-minor\n  dependency-group: webui-deps-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the webui-deps-minor-patch group across 1 directory…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T23:49:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "64c8ca8396283d1dbf2be52586c14553de7277ed",
          "body": "Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.0.\n- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md)\n- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: js-yaml\n  dependency-version: 4.3.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps-dev): bump js-yaml from 4.1.1 to 4.3.0 in /webui (#398)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T23:42:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6a7642b99c9c8d1c99c7b9efaa700cca5746065",
          "body": "Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.14 to 8.1.3.\n- [Release notes](https://github.com/vitejs/vite/releases)\n- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)\n- [Commits](https://github.com/vitejs/vite/commits/v8.1.3/packages/\n[…]\nndency-version: 8.1.3\n  dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps-dev): bump vite from 8.0.14 to 8.1.3 in /webui (#416)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T23:42:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "93c17130db0ccb39c5d77408495f015f25736075",
          "body": "…th 16 updates (#424)\n\nBumps the go-deps-minor-patch group with 10 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/creativeprojects/go-selfupdate](https://github.com/creativeprojects/go-selfupdate) | `1.5.2` | `1.6.0` |\n| [github.com/docker/go-connections](http\n[…]\nupdate:semver-minor\n  dependency-group: go-deps-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-deps-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T23:41:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "287b367969dccab3bcd30e78f3d47400e3ca0e49",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(beads): record pending interaction line before schema reconcile",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-17T23:40:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "496a15ad2257e1666ff485076a0331022e98c748",
          "body": "chore(main): release 0.38.0",
          "is_bot": true,
          "headline": "Merge pull request #425 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-17T23:38:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7b0cb5b6bce7668637801ad2cdf5bc0c7d20f00d",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.38.0",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-17T23:38:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c75ca023b8ff3c16a7d18d0b0012b6581452283",
          "body": "…onfig (#390/#391), retain-old deploy swap (#343)\n\n* docs(plans): resilience slate — triaged fix plan (#390/#391, #345, #343) — panel-reviewed\n\nTriaged plan over the 94-issue backlog in three sub-clusters: config-loading correctness (#390/#391), security fail-open (#345), destructive-window atomicit\n[…]\nCloses #342\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: resilience slate — fail-closed webhooks (#345), default-target c…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-17T23:38:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "290383b45bf85321ebcece59d4413cd274a324cf",
          "body": "chore(main): release 0.37.10",
          "is_bot": true,
          "headline": "Merge pull request #421 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-02T22:10:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d72438eb9aab808e3a9d25029678fbe66ac93ef",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.10",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T22:10:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0eaa9464d5de1c25f2d35ba4da5cf9a6e71f0d7",
          "body": "…egrity, resets stream per retry (#406)\n\n* fix(reconcile): BackupRemote fails on SSH error, verifies archive integrity, resets stream per retry\n\nBackupRemote treated a non-nil ssh/tar error as non-fatal, then let a\nlisting-only VerifyBackup pass the streamed archive and returned success —\nso a backu\n[…]\nand\nreturns the newest verified. go build/vet clean; full module suite green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): BackupRemote fails on SSH error, verifies archive int…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T22:10:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b1591016baf6828ce8b8aa0ed89e02dc1bc6eeb5",
          "body": "chore(main): release 0.37.9",
          "is_bot": true,
          "headline": "Merge pull request #420 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-02T21:57:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "830394fbe760c0542b20c4a1e6a65cadc74c6074",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.9",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T21:57:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5ca4db0b5d8d40d5724eea4b02f5f7491e6cc28c",
          "body": "…rect type docs (#409)\n\n* fix(drift): validate drift_ignore types and globs at config load; correct type docs\n\nDrift ignore rules accepted undocumented type values (the doc comment\nclaimed \"stopped\" and \"extra\" exist, but only missing/image_mismatch/\nunhealthy are implemented) and invalid glob patte\n[…]\nprobe in\nvalidation.go noting that the \"\" target is not a real match attempt.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(drift): validate drift_ignore types and globs at config load; cor…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:57:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "80f8c0706b73967ad62d76ae24f88c1079ac562c",
          "body": "chore(main): release 0.37.8",
          "is_bot": true,
          "headline": "Merge pull request #418 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-02T21:50:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4aec6c0fa0db4b5b0cd843b665000d11d98f9108",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.8",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T21:50:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "706ef2d04cc550074fcca3e1b8a8c79a7383a10f",
          "body": "…meout (#410)\n\nWebhook, socket, TCP, and API triggers already wrap their context with\nReconcileTimeout before calling TriggerReconcile, but startup, poll, and\ndrift-self-heal pass the bare daemon context — a blocked r.Run(ctx) on\nthose paths wedges the reconcile loop forever (d.reconciling never\nclears; coalesced triggers pile up and never run). Apply the timeout\nonce in executeReconcile so every trigger source is bounded uniformly.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(daemon): bound startup/poll/self-heal reconciles with ReconcileTi…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:50:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "79a09e2e972109d45800230ce22dd13cd7852280",
          "body": "* fix(drift): don't advance alert throttle when delivery fails\n\nsendDriftAlert and sendDriftResolvedAlert swallowed the error from the\nalerter, so all three call sites (drift alert, in-drift resolution,\nno-drift resolution) unconditionally updated DriftAlertedItems even when\ndelivery failed. A dropp\n[…]\ns, which only covered the drift-alert-fires and no-drift\nresolution branches.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(drift): don't advance alert throttle when delivery fails (#408)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:49:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ee5856a8919406c19ca8faff4a01ee52ef7690cd",
          "body": "…all paralysis (#411)\n\nDefaultLockFile is /var/run/bosun/reconcile.lock, but nothing ever\ncreates /var/run/bosun. On a fresh host (tmpfs /var/run), acquireLock's\nOpenFile fails with ENOENT, which Run() turns into the misleading\n\"another reconciliation may be in progress\" -- permanent paralysis\nsince\n[…]\n parent once in Run() before acquiring the lock; every target\n(default and named) shares the same base lock dir, so one call covers\nall of them.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): auto-create lock file directory to prevent fresh-inst…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:49:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "71f10e3dbc28e28937c03dd4d45fe2edbc8f848e",
          "body": "chore(main): release 0.37.7",
          "is_bot": true,
          "headline": "Merge pull request #417 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-02T21:46:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d01c9686e90ef0513e511751aae924d6d73f766c",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.7",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T21:46:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "30aff14b3f5250684ac13d7fce026b5ccb0153ef",
          "body": "…state fragmentation (#407)\n\nThe reserved \"default\" target name was matched case-sensitively, so a config\ntarget named \"Default\"/\"DEFAULT\"/\"DeFaUlT\" slipped past the reserved gate,\nIsDefault() returned false, and ConfigForTarget derived a per-name state set\n(deploy-state-Default.json, staging/Defaul\n[…]\nfunction sanitizes fields and does not\nfilter reserved names, so the reserved-name assertions belong with the functions\nthat implement the gate.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): casefold reserved \"default\" target checks to prevent …",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:46:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "71083d0837281cdf48f2058967ad3101f556b624",
          "body": "chore(main): release 0.37.6",
          "is_bot": true,
          "headline": "Merge pull request #413 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-02T21:42:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84fc77f3939efd56670ab83d47d131037c2cfccf",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.6",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T21:42:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3db9fcfeef219f44e0d112a74d0b91640e19e166",
          "body": "chore(main): release 0.37.6",
          "is_bot": true,
          "headline": "Merge pull request #412 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-07-02T21:42:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6edc2bca19c2e16b51ecde7fa6561efc3d1fba9a",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.6",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T21:42:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8cade1ca2ba0ab0a142f6b1ecde34e3a079f483f",
          "body": "…fire on mixed commits (#405)\n\nremoveStaleFiles pruned stale files from the deploy target but recorded\nnothing about it, so a mixed commit (a write to one service plus a\nhook-matched deletion in another) took the WrittenFiles-only branch in\nexecutePostSyncHooks and the deletion's hook never fired. P\n[…]\n mirroring PrefixLatest for staging-relative hook glob\nmatching. executePostSyncHooks now combines both lists when deciding which\nfiles changed.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): record removeStaleFiles deletions so post-sync hooks …",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:41:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c4c8146c5ed9647b2edc670c3d00191cd59218ab",
          "body": "…f re-running the failed deploy (#403)\n\nrunHealthGate's rollback path called ComposeUpMultipleWithRollback, which\nre-runs `docker compose up -d` against r.lastComposeFiles before attempting\nrollback. Against containers that are already created but unhealthy, compose\nup exits 0 without touching anyth\n[…]\nit after its own\nfailed deploy, preserving its existing deploy-then-rollback error semantics.\nThe health gate calls RollbackFromBackup directly.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): health-gate rollback redeploys backup files instead o…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:41:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d69e759bc80fda1af074c8ea62718fce09800a52",
          "body": "…r API errors (#404)\n\nThe deadline check lived only inside the success branch of the poll loop, so\na persistent CollectActualState error never reached it. The only remaining\nexit was ctx.Done(), which never fires unless the caller's context itself has\na deadline — so a Docker API that keeps erroring\n[…]\nccess or\nerror, and add a deadline-aware arm to the select so the loop doesn't\novershoot by up to a full poll interval waiting on the next tick.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): pollContainerHealth honors its timeout when the Docke…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:41:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5d7902f331b8d4ef277a93231ab4900624086092",
          "body": "…r warn for FUSE/Unraid paths (#402)\n\nThree related fixes for Unraid shfs (FUSE) deploy staleness:\n\n1. CopyFile now fsyncs the destination directory after the atomic\n   rename. On FUSE mounts a rename's directory-entry update is not\n   guaranteed durable/visible to a second FUSE handle until the par\n[…]\nlay is unset for a\n   /mnt/user (FUSE) deploy target, nudging toward explicit config\n   rather than relying solely on the new heuristic default.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(hooks): fsync dest dir after rename; settle-delay default + docto…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:41:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e2670e61f6db92f3c943e6301fbdaa38144a799a",
          "body": "matchGlob's hand-rolled ** handling only ever looked at the prefix\nbefore the first **, so any pattern with a suffix after ** (e.g.\n\"**/foo.yml\" or \"appdata/**/dynamic.yml\") silently degraded to\nmatching every file under the prefix directory — discarding the\nsuffix constraint entirely. This affects \n[…]\nich implements full glob \"**\" recursive-directory semantics\n(prefix, middle, or trailing), so a suffix after ** is honored\ninstead of discarded.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(hooks): use doublestar so ** glob suffixes are honored (#401)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-07-02T21:41:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a18395dd7eadc0d0367109e73f16004e6e72767c",
          "body": "Records that github.com/docker/docker is end-of-line at v28.5.2+incompatible\nin the internal/docker section, with pointers to:\n\n- The stable successor split modules (moby/moby/api v1.54.2+, moby/moby/client\n  v0.4.1+) and the v2 beta path\n- The shape of the API port (Options moved to client, methods\n[…]\nscovery\n- The operational frame: remaining docker/docker SDK CVEs are daemon-side\n  and not reachable from bosun's client-only usage\n\nSaves the next docker-related session 30+ minutes of re-discovery.",
          "is_bot": false,
          "headline": "docs: note docker SDK end-of-line + moby/moby successor split [skip-ci]",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-30T14:27:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bbd6a7daafe200ffea2b28ea02a7990ca4428f9b",
          "body": "…s) (#380)\n\n* ci: add Dependabot config for weekly grouped dep PRs\n\nAdds gomod (/), npm (/webui, /scripts/diagrams) and github-actions\necosystems on a Monday weekly schedule. Minor/patch updates collapse\ninto one grouped PR per ecosystem to avoid per-package PR storms; major\nbumps still surface indi\n[…]\nape hatch needed.\n\nVerified: tsc --noEmit clean, eslint clean, vite build clean (88ms),\nnpm audit shows 0 vulnerabilities.\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): vite 8 webui bump + Dependabot config (closes 4 of 9 CVE…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-30T14:08:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "02d15202409639947b5646d34de0e54e0d02e62f",
          "body": "…tes (#379)\n\nBumps the go_modules group with 1 update in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git).\n\n\nUpdates `github.com/go-git/go-git/v5` from 5.17.2 to 5.19.1\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-gi\n[…]\n\n  dependency-type: indirect\n  dependency-group: go_modules\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go_modules group across 1 directory with 2 upda…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-30T13:42:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ae5280299becc38db4a6ef52ebbf6222b602a97",
          "body": "…enable readiness [skip-ci]\n\nTwo investigation field reports from the #373/#375/#376 deploy-invariant\nbacklog session:\n\n- coderabbit-review-loop-stalls-and-advisory-gates: the ~50-min CodeRabbit\n  stall on #375, the no-branch-protection/UNSTABLE-vs-BLOCKED advisory-gate\n  discovery, and the multi-pa\n[…]\ndeRabbit 'Review triggered'\nack is not a guarantee, and the merge gate is advisory on this repo.\n\nIndex entries: bosun-271, bosun-g74 (closed).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: field reports for CodeRabbit review-loop stalls and homelab re-…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T22:17:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "08b5534f52f729ab2e092a445aff821460170066",
          "body": "chore(main): release 0.37.5",
          "is_bot": true,
          "headline": "Merge pull request #377 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-05-28T20:39:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70e0f48dc0cbe72ec020b7a3e3f6247e17b1c5ba",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.5",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-28T20:39:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca1a30ac20b42a736d5677107f6ddd53f40effe1",
          "body": "…(#375)\n\n* fix(reconcile): scope pre-deploy backup to deployed config footprint\n\nThe pre-deploy backup tarred whole appdata target directories, sweeping in\nlarge runtime data (media, databases, caches) co-located with bosun's config.\nOn a real homelab that archive never finished within BACKUP_TIMEOU\n[…]\neds path.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): scope pre-deploy backup to deployed config footprint …",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T20:38:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3513caf945f7e86b24a1bdd029f7c6a7d3062cf9",
          "body": "… (#376)\n\n* docs: correct daemon API reference and document breaker/ports/migrate [skip-ci]\n\nSalvage the accurate, verifiable half of PR #362's docs overhaul (bosun-vam):\n\n- daemon-split.md: add an implementation-status banner with the real daemon\n  interfaces (Unix socket /var/run/bosun.sock primar\n[…]\nnly split\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: correct daemon API reference and document breaker/ports/migrate…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T18:32:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9439d404a2b6463090eac7ad7614494a344031aa",
          "body": "…nges (#373)\n\nArchive three fully-implemented OpenSpec changes so the base reconcile spec\nreflects shipped behavior:\n\n- deploy-state-and-ssh-known-hosts (6/6) — folds known_hosts resolution +\n  state.CommitHash hook diff base into Git Repository Sync / Post-Sync Hooks\n- add-infra-dir-misconfig-hint \n[…]\nlta before archiving (MODIFIED replaces the whole block).\n\nResolves bosun-1xr\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(openspec): archive implemented deploy-sync/state/infra-hint cha…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T17:24:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a065bbc09ebbbf92ee720fd7f4602ac5178cdab2",
          "body": "…[skip-ci]\n\nBoth #368 and #371 lost a CI round-trip to the same codecov/patch miss on\nnew error-propagation branches. Document the two fault-injection idioms\n(chmod 0000 -> FileHash failure; regular-file-as-parent -> Lstat ENOTDIR)\nso the next error-handling change ships coverage in the first push.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: note codecov/patch fault-injection pattern in testing guidance …",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T16:06:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8170a01d850fe59e759bda61452728926710232b",
          "body": "…ed in #371) [skip-ci]",
          "is_bot": false,
          "headline": "chore(beads): close bosun-lov (deploy invariant content-equality merg…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T15:59:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b03ba800bfcf1b2dae619db19ee57e46b161b0b8",
          "body": "chore(main): release 0.37.4",
          "is_bot": true,
          "headline": "Merge pull request #372 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-05-28T15:59:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9111cb5e0d0c83ad059033e5c463957f2a24cfd0",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.4",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-28T15:58:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c616c511d6a9f6f4b67e414b48f7763ed78d55c2",
          "body": "…nk semantics (#371)\n\nUpgrades the deploy-sync empty-write invariant from existence-only (the #368\nGH#330 interim fix) to content-equality, and fixes two symlink-handling gaps.\n\n- verify.go: destinationSatisfiesSource confirms each regular source file is\n  byte-identical at the destination (SHA-256 \n[…]\npath coverage.\n- Spec: Invariant 3 -> atomic SHALL clauses (existence -> content-equality) +\n  stale-content/symlink scenarios. Docs: gitops.md + troubleshooting.md.\n\nRefs: GH#330 (salvaged from #362)",
          "is_bot": false,
          "headline": "fix(reconcile): harden deploy invariant with content-equality + symli…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T15:58:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c31d2568186f0731336669dd49a03e8eb68732b",
          "body": "chore(main): release 0.37.3",
          "is_bot": true,
          "headline": "Merge pull request #370 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-05-28T13:33:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d884727f66922f69575b168b6a22c25b62e699be",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.3",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-28T13:32:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "def175a660758779c224539b8dc8aebfd071ab23",
          "body": "Partial compose-up failures now propagate as a deploy failure (via partialDeployError) instead of returning nil — keeps NeedsRedeploy set, fires a failure alert, counts toward the circuit breaker, and retries next reconcile. Mirrors the post-deploy health gate. Closes #333.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): treat partial compose failure as deploy failure (#333)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T13:32:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f64fd77a1db93e458885e399cd262e0ec57889f5",
          "body": "chore(main): release 0.37.2",
          "is_bot": true,
          "headline": "Merge pull request #369 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-05-28T12:51:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "30ed7ba9d3c4e9a81404550f028eeaf8868277bd",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.2",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-28T12:51:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a567eaf37aaf9b4224d58c9ed6a54260eaaae217",
          "body": "…nvariant (#330)\n\nInspect the destination on zero-write deploys instead of inferring failure from the write count. No-op (content-matched) passes; missing files still error. Closes #330.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): no-op content-hash sync no longer trips empty-write i…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-28T12:51:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "becf2620ac6bea71a05151a95cd5cea00d7d71d9",
          "body": "…p-ci]\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(field-report): deploy-chain hardening + bind-mount topology [ski…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-27T00:04:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "bffb635444f39d5a89795caf3b5b3e1dd6a756c3",
          "body": "…is) [skip-ci]\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(beads): close bosun-n4x (deploy blast-radius resolved by analys…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-26T23:58:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "27b9b136bf420e922a6e5a5938dc3e76d066c214",
          "body": "chore(main): release 0.37.1",
          "is_bot": true,
          "headline": "Merge pull request #367 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-05-26T23:58:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8a5142b14f339a55f15ee26597da6bc8d2bf1ac",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.1",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-26T23:57:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1ed70042009a4b87c351ae40b584db9e2f32788",
          "body": "…n (#332/#335) (#366)\n\n* fix(reconcile): prune only bosun-managed files, never runtime data (GH#331)\n\nremoveStaleFiles ran rsync --delete semantics over every appdata target\ndir on each content-hash-sync reconcile, deleting any target file absent\nfrom the repo source. The repo's appdata/<svc> dirs a\n[…]\nthrowing.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(reconcile): managed-set prune (#331) + rollback archive extractio…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-26T23:57:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e903857365dd631e0fe0daf4590f55fc98a19cc2",
          "body": "…i] (#329)\n\nCapture the Wave-1 spec/logging PR backlog merge and the #312-vs-#319\nOpenSpec MODIFIED-requirement hazard: archive replaces the whole\nrequirement block, so #312 would have silently reverted #319's\nalready-merged BackupTimeout/ctx-verification/self-exclusion clauses.\nDocuments the struct\n[…]\ntion) and the CI\nharness fix (#328) that derives change IDs from the PR diff.\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(field-report): spec-merge-order as a correctness concern [skip-c…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-25T17:57:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c91139c12ed9d5b1d51c44eccb9a79c3e4227bb6",
          "body": "…ame (#328)\n\nThe Validate Spec job derived the change ID from the branch name\n(CHANGE_ID=\"${BRANCH#spec/}\"), which assumes branch name == change ID. That\nholds for net-new proposals but breaks for fold/refactor PRs: #313's branch\nspec/fold-cluster-c-multitarget edits the existing change\nadd-multi-ta\n[…]\nare passed via env and only used as\nquoted shell variables. Closes bosun-6wu.\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(spec-review): validate changed change-dirs from diff, not branch n…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-25T17:40:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b5d75009cc43beaace76f7d916583a7a0316ff4b",
          "body": "chore(main): release 0.37.0",
          "is_bot": true,
          "headline": "Merge pull request #327 from cameronsjo/release-please--branches--main",
          "author_name": "forge-bellows[bot]",
          "author_login": "forge-bellows[bot]",
          "committed_at": "2026-05-25T17:26:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "77ce61279f5b3b9d5ec3fb641c50a0d9c033abe4",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.37.0",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-25T17:26:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6057d3de57aaa2808307035e4466353ea937e2c4",
          "body": "* feat(log): add narrative structured logging across operational core\n\nInstrument the GitOps engine, daemon, Docker/manifest, and alert\nsubsystems with action-oriented Before/Success/Failure log narratives\nso a reconcile run reads as a story at 2am.\n\n- reconcile: git/SOPS/template/deploy/compose/hea\n[…]\n-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(log): narrative structured logging across operational core (#316)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-25T17:26:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "461d7a4808e631944478243caff9b7b53f484891",
          "body": "…313)\n\n* docs(spec): fold Cluster C target-safety into add-multi-target-reconcile\n\nAdds two ADDED requirements to the in-flight multi-target proposal capturing\nthe bug-hunt findings about target validation and isolation safety:\n\n- Target Configuration Validation — path-traversal rejection for target\n[…]\ny comply.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "spec: fold Cluster C target-safety into add-multi-target-reconcile (#…",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-25T17:20:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2e4d0d0c1c1aa6a62c357b9bc876a093dcb1c33c",
          "body": "…deploy errors (Cluster H) (#312)\n\n* docs(spec): add-backup-integrity-semantics proposal (Cluster H)\n\nSpec deltas for backup integrity + deploy error semantics in the\nreconcile pipeline: verified fail-closed backups (#240/#244), retention\nthat preserves the last-known-good (#243), propagated deploy-\n[…]\npipeline.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "spec: add-backup-integrity-semantics — verified backups + propagated …",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-25T17:19:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "276300c1778f332cb747ccfd6e064377aac77b6d",
          "body": "Spec-only proposal hardening the post-deploy hook + FUSE-propagation\npath of the reconcile pipeline. Adds a reconcile-fuse-hooks capability\n(glob correctness, FUSE-safe timing, match observability, post-write\nverification, hot-reload removal semantics) and modifies the reconcile\nPost-Sync Container \n[…]\nd rejection). Covers #232 #233 #234 #269 #267 #268\n#282 #283.\n\nRefs bosun-bzz\n\nCo-authored-by: Cameron Sjo <cameronsjo@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(spec): add-reconcile-fuse-hooks proposal (Cluster D) (#311)",
          "author_name": "Cameron Sjo",
          "author_login": "cameronsjo",
          "committed_at": "2026-05-25T16:44:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 95,
      "commits_last_year": 934,
      "latest_release_at": "2026-07-19T22:18:42Z",
      "latest_release_tag": "v0.39.3",
      "releases_from_tags": false,
      "days_since_last_push": 3,
      "active_weeks_last_year": 17,
      "days_since_latest_release": 4,
      "mean_days_between_releases": 0.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 71,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/cameronsjo/bosun",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/cameronsjo/bosun",
          "is_deprecated": false,
          "latest_version": "v0.39.3",
          "repository_url": "https://github.com/cameronsjo/bosun",
          "versions_count": 95,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-19T22:18:32Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 85
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": true,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "webui/tsconfig.json"
      ],
      "toolchain_manifests": [
        "dagger/go.mod",
        "go.mod"
      ],
      "largest_source_bytes": 186708,
      "source_files_sampled": 253,
      "oversized_source_files": 5,
      "agent_instruction_files": [
        ".clinerules",
        ".cursorrules",
        ".github/copilot-instructions.md",
        ".windsurfrules",
        "AGENTS.md",
        "CLAUDE.md",
        "GEMINI.md",
        "openspec/AGENTS.md"
      ],
      "agent_instruction_max_bytes": 27289
    },
    "dependencies": {
      "manifests": [
        "dagger/go.mod",
        "go.mod",
        "webui/package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.81.1",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 2
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "1.1.15",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-3jxr-9vmj-r5cp"
            ],
            "fixed_version": "5.0.7",
            "advisory_count": 1,
            "oldest_advisory_days": 3
          },
          {
            "name": "@babel/core",
            "direct": false,
            "version": "7.28.5",
            "severity": "low",
            "ecosystem": "npm",
            "cvss_score": 3.2,
            "advisory_ids": [
              "GHSA-4x5r-pxfx-6jf8"
            ],
            "fixed_version": "8.0.0-rc.6",
            "advisory_count": 1,
            "oldest_advisory_days": 39
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 16
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "low": 1,
          "high": 1,
          "unknown": 2,
          "critical": 1
        },
        "advisory_count": 5,
        "affected_count": 5,
        "assessed_count": 421,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.0"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.10.0"
        },
        {
          "name": "github.com/creativeprojects/go-selfupdate",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/fatih/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.0"
        },
        {
          "name": "github.com/getsentry/sentry-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "github.com/getsentry/sentry-go/zerolog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "github.com/getsops/sops/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.13.2"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.19.1"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/kballard/go-shellquote",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180428030007-95032a82bc51"
        },
        {
          "name": "github.com/moby/moby/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.55.0"
        },
        {
          "name": "github.com/moby/moby/client",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.0"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.2"
        },
        {
          "name": "github.com/rs/zerolog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.35.1"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.53.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.44.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "react",
          "manifest": "webui/package.json",
          "ecosystem": "npm",
          "version_constraint": "^19.2.7"
        },
        {
          "name": "react-dom",
          "manifest": "webui/package.json",
          "ecosystem": "npm",
          "version_constraint": "^19.2.7"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": true,
            "version": "v4.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/creativeprojects/go-selfupdate",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": true,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/getsentry/sentry-go",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/getsentry/sentry-go/zerolog",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/getsops/sops/v3",
            "direct": true,
            "version": "v3.13.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.19.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kballard/go-shellquote",
            "direct": true,
            "version": "v0.0.0-20180428030007-95032a82bc51",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": true,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": true,
            "version": "v1.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": true,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": true,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/zerolog",
            "direct": true,
            "version": "v1.35.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": true,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "react",
            "direct": true,
            "version": "19.2.7",
            "ecosystem": "npm"
          },
          {
            "name": "react-dom",
            "direct": true,
            "version": "19.2.7",
            "ecosystem": "npm"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/kms",
            "direct": false,
            "version": "v1.31.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/longrunning",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.29.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.63.0",
            "ecosystem": "go"
          },
          {
            "name": "code.gitea.io/sdk/gitea",
            "direct": false,
            "version": "v0.23.2",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/age",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/edwards25519",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/hpke",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/42wim/httpsig",
            "direct": false,
            "version": "v1.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.25",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/s3/manager",
            "direct": false,
            "version": "v1.22.28",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/kms",
            "direct": false,
            "version": "v1.53.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.104.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.31.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.36.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.43.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azcore",
            "direct": false,
            "version": "v1.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azidentity",
            "direct": false,
            "version": "v1.14.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/internal",
            "direct": false,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/azkeys",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/internal",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azuread/microsoft-authentication-library-for-go",
            "direct": false,
            "version": "v1.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver",
            "direct": false,
            "version": "v3.5.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v4",
            "direct": false,
            "version": "v4.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20260202195803-dba9d589def2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cpuguy83/go-md2man/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davidmz/go-pageant",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.37.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/getsops/gopgagent",
            "direct": false,
            "version": "v0.0.0-20241224165529-7044f28e491e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-fed/httpsig",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": false,
            "version": "v5.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang-jwt/jwt/v5",
            "direct": false,
            "version": "v5.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-github/v86",
            "direct": false,
            "version": "v86.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-querystring",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/shlex",
            "direct": false,
            "version": "v0.0.0-20191202100458-e7afc7fbc510",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.33.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goware/prefixer",
            "direct": false,
            "version": "v0.0.0-20160118172347-395022866408",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-retryablehttp",
            "direct": false,
            "version": "v0.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-rootcerts",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-secure-stdlib/parseutil",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-secure-stdlib/strutil",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-sockaddr",
            "direct": false,
            "version": "v1.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl",
            "direct": false,
            "version": "v1.0.1-vault-7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/vault/api",
            "direct": false,
            "version": "v1.23.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huaweicloud/huaweicloud-sdk-go-v3",
            "direct": false,
            "version": "v0.1.202",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.13-0.20220915233716-71ac16282d12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kylelemons/godebug",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lib/pq",
            "direct": false,
            "version": "v1.12.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": false,
            "version": "v3.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/mapstructure",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/browser",
            "direct": false,
            "version": "v0.0.0-20240102092130-5ac0b6a4141c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.66.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.16.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/russross/blackfriday/v2",
            "direct": false,
            "version": "v2.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ryanuber/go-glob",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": false,
            "version": "v1.3.2-0.20230802210424-5b0b94c5c0d3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tjfoc/gmsm",
            "direct": false,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": false,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/urfave/cli",
            "direct": false,
            "version": "v1.22.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "gitlab.com/gitlab-org/api/client-go",
            "direct": false,
            "version": "v1.46.0",
            "ecosystem": "go"
          },
          {
            "name": "go.mongodb.org/mongo-driver",
            "direct": false,
            "version": "v1.17.9",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.2",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.286.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260622175928-b703f567277d",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260622175928-b703f567277d",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260622175928-b703f567277d",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.81.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/ini.v1",
            "direct": false,
            "version": "v1.67.3",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "@babel/code-frame",
            "direct": false,
            "version": "7.27.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/compat-data",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/core",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/generator",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-compilation-targets",
            "direct": false,
            "version": "7.27.2",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-globals",
            "direct": false,
            "version": "7.28.0",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-module-imports",
            "direct": false,
            "version": "7.27.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-module-transforms",
            "direct": false,
            "version": "7.28.3",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-string-parser",
            "direct": false,
            "version": "7.27.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-identifier",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-option",
            "direct": false,
            "version": "7.27.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helpers",
            "direct": false,
            "version": "7.28.4",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/parser",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/template",
            "direct": false,
            "version": "7.27.2",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/traverse",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/types",
            "direct": false,
            "version": "7.28.5",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/core",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/runtime",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/wasi-threads",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint-community/eslint-utils",
            "direct": false,
            "version": "4.9.1",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint-community/regexpp",
            "direct": false,
            "version": "4.12.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/config-array",
            "direct": false,
            "version": "0.21.1",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/config-helpers",
            "direct": false,
            "version": "0.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/core",
            "direct": false,
            "version": "0.17.0",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/eslintrc",
            "direct": false,
            "version": "3.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/js",
            "direct": false,
            "version": "9.39.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/object-schema",
            "direct": false,
            "version": "2.1.7",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/plugin-kit",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/core",
            "direct": false,
            "version": "0.19.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/node",
            "direct": false,
            "version": "0.16.7",
            "ecosystem": "npm"
          },
          {
            "name": "@humanwhocodes/module-importer",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanwhocodes/retry",
            "direct": false,
            "version": "0.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/gen-mapping",
            "direct": false,
            "version": "0.3.13",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/remapping",
            "direct": false,
            "version": "2.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/resolve-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/trace-mapping",
            "direct": false,
            "version": "0.3.31",
            "ecosystem": "npm"
          },
          {
            "name": "@napi-rs/wasm-runtime",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "@napi-rs/wasm-runtime",
            "direct": false,
            "version": "1.1.6",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-project/types",
            "direct": false,
            "version": "0.139.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-android-arm64",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-darwin-arm64",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-darwin-x64",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-freebsd-x64",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-arm-gnueabihf",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-arm64-gnu",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-arm64-musl",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-ppc64-gnu",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-s390x-gnu",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-x64-gnu",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-x64-musl",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-openharmony-arm64",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-wasm32-wasi",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-win32-arm64-msvc",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-win32-x64-msvc",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/pluginutils",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/node",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-android-arm64",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-darwin-arm64",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-darwin-x64",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-freebsd-x64",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-arm-gnueabihf",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-arm64-gnu",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-arm64-musl",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-x64-gnu",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-x64-musl",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-wasm32-wasi",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-win32-arm64-msvc",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-win32-x64-msvc",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/vite",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "@tybys/wasm-util",
            "direct": false,
            "version": "0.10.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tybys/wasm-util",
            "direct": false,
            "version": "0.10.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/estree",
            "direct": false,
            "version": "1.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "@types/json-schema",
            "direct": false,
            "version": "7.0.15",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "26.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@types/react",
            "direct": false,
            "version": "19.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "@types/react-dom",
            "direct": false,
            "version": "19.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/eslint-plugin",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/parser",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/project-service",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/scope-manager",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/tsconfig-utils",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/type-utils",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/types",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/typescript-estree",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/utils",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/visitor-keys",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "@vitejs/plugin-react",
            "direct": false,
            "version": "6.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "acorn",
            "direct": false,
            "version": "8.15.0",
            "ecosystem": "npm"
          },
          {
            "name": "acorn-jsx",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.15.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "argparse",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "balanced-match",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "balanced-match",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "baseline-browser-mapping",
            "direct": false,
            "version": "2.9.11",
            "ecosystem": "npm"
          },
          {
            "name": "beautiful-mermaid",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "1.1.15",
            "ecosystem": "npm"
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "5.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "browserslist",
            "direct": false,
            "version": "4.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "callsites",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "caniuse-lite",
            "direct": false,
            "version": "1.0.30001762",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "color-convert",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "color-name",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "concat-map",
            "direct": false,
            "version": "0.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "convert-source-map",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "csstype",
            "direct": false,
            "version": "3.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "deep-is",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "detect-libc",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "electron-to-chromium",
            "direct": false,
            "version": "1.5.267",
            "ecosystem": "npm"
          },
          {
            "name": "elkjs",
            "direct": false,
            "version": "0.11.0",
            "ecosystem": "npm"
          },
          {
            "name": "enhanced-resolve",
            "direct": false,
            "version": "5.24.2",
            "ecosystem": "npm"
          },
          {
            "name": "entities",
            "direct": false,
            "version": "7.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "escalade",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "escape-string-regexp",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "eslint",
            "direct": false,
            "version": "9.39.2",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-plugin-react-hooks",
            "direct": false,
            "version": "7.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-plugin-react-refresh",
            "direct": false,
            "version": "0.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-scope",
            "direct": false,
            "version": "8.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "3.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "4.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "espree",
            "direct": false,
            "version": "10.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "esquery",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "esrecurse",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "estraverse",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "esutils",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-deep-equal",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-json-stable-stringify",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "fast-levenshtein",
            "direct": false,
            "version": "2.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "fdir",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "file-entry-cache",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "find-up",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "flat-cache",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "flatted",
            "direct": false,
            "version": "3.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "fsevents",
            "direct": false,
            "version": "2.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "gensync",
            "direct": false,
            "version": "1.0.0-beta.2",
            "ecosystem": "npm"
          },
          {
            "name": "glob-parent",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "globals",
            "direct": false,
            "version": "14.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "globals",
            "direct": false,
            "version": "17.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "graceful-fs",
            "direct": false,
            "version": "4.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "has-flag",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "hermes-estree",
            "direct": false,
            "version": "0.25.1",
            "ecosystem": "npm"
          },
          {
            "name": "hermes-parser",
            "direct": false,
            "version": "0.25.1",
            "ecosystem": "npm"
          },
          {
            "name": "ignore",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "ignore",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "import-fresh",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "imurmurhash",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "is-extglob",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-glob",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jiti",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "js-tokens",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "js-yaml",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "jsesc",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-buffer",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-schema-traverse",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-stable-stringify-without-jsonify",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json5",
            "direct": false,
            "version": "2.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "keyv",
            "direct": false,
            "version": "4.5.4",
            "ecosystem": "npm"
          },
          {
            "name": "levn",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-android-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-freebsd-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm-gnueabihf",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-arm64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-x64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "locate-path",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.merge",
            "direct": false,
            "version": "4.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "lru-cache",
            "direct": false,
            "version": "5.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "magic-string",
            "direct": false,
            "version": "0.30.21",
            "ecosystem": "npm"
          },
          {
            "name": "minimatch",
            "direct": false,
            "version": "10.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "minimatch",
            "direct": false,
            "version": "3.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "ms",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.16",
            "ecosystem": "npm"
          },
          {
            "name": "natural-compare",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "node-releases",
            "direct": false,
            "version": "2.0.27",
            "ecosystem": "npm"
          },
          {
            "name": "optionator",
            "direct": false,
            "version": "0.9.4",
            "ecosystem": "npm"
          },
          {
            "name": "p-limit",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-locate",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "parent-module",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-exists",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "postcss",
            "direct": false,
            "version": "8.5.19",
            "ecosystem": "npm"
          },
          {
            "name": "prelude-ls",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "punycode",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "rolldown",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "scheduler",
            "direct": false,
            "version": "0.27.0",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "6.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "7.8.5",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "source-map-js",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-json-comments",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "supports-color",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "tailwindcss",
            "direct": false,
            "version": "4.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "tapable",
            "direct": false,
            "version": "2.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "ts-api-utils",
            "direct": false,
            "version": "2.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "tslib",
            "direct": false,
            "version": "2.8.1",
            "ecosystem": "npm"
          },
          {
            "name": "type-check",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "5.9.3",
            "ecosystem": "npm"
          },
          {
            "name": "typescript-eslint",
            "direct": false,
            "version": "8.64.0",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "8.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "update-browserslist-db",
            "direct": false,
            "version": "1.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "uri-js",
            "direct": false,
            "version": "4.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "vite",
            "direct": false,
            "version": "8.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "word-wrap",
            "direct": false,
            "version": "1.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "yallist",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "yocto-queue",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": false,
            "version": "4.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "zod-validation-error",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 421,
        "direct_count": 26,
        "indirect_count": 395
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 4,
        "merged_prs": 264,
        "open_issues": 81,
        "closed_ratio": 0.555,
        "closed_issues": 101,
        "closed_unmerged_prs": 17
      },
      "bus_factor": 1,
      "bot_contributors": 3,
      "top_contributors": [
        {
          "type": "User",
          "login": "cameronsjo",
          "commits": 722,
          "avatar_url": "https://avatars.githubusercontent.com/u/4084915?v=4"
        },
        {
          "type": "User",
          "login": "claude",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/81847?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.992
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "claude.yml",
        "llms-txt-sync.yml",
        "release-please.yml",
        "spec-review.yml",
        "webui.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml",
        "eslint.config.js"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json",
        "pnpm-lock.yaml",
        "uv.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 6,
            "reason": "14 out of 21 merged PRs checked by a CI test -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/12 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 1,
            "reason": "dependency not pinned by hash detected -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 5,
            "reason": "5 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "26cb1b561d0c97ae8c616c2ba18c21ef26bea7f2",
        "ran_at": "2026-07-24T19:21:48Z",
        "aggregate_score": 4.9,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-20T22:58:31Z",
      "oldest_open_prs": [
        {
          "number": 389,
          "created_at": "2026-05-30T14:10:41Z",
          "last_comment_at": "2026-07-19T16:37:24Z",
          "last_comment_author": "cameronsjo"
        },
        {
          "number": 465,
          "created_at": "2026-07-20T10:25:51Z",
          "last_comment_at": "2026-07-20T10:26:03Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 466,
          "created_at": "2026-07-20T10:26:00Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 467,
          "created_at": "2026-07-20T10:26:08Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-19T22:18:32Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 165,
          "created_at": "2026-03-21T03:01:03Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 218,
          "created_at": "2026-04-05T15:53:44Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 226,
          "created_at": "2026-05-04T00:02:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 242,
          "created_at": "2026-05-19T00:43:15Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 243,
          "created_at": "2026-05-19T00:43:17Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 244,
          "created_at": "2026-05-19T00:43:18Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 245,
          "created_at": "2026-05-19T00:43:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 246,
          "created_at": "2026-05-19T00:43:20Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 247,
          "created_at": "2026-05-19T00:43:21Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 248,
          "created_at": "2026-05-19T00:43:23Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 249,
          "created_at": "2026-05-19T00:43:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 250,
          "created_at": "2026-05-19T00:43:25Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 251,
          "created_at": "2026-05-19T00:43:26Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 252,
          "created_at": "2026-05-19T00:43:27Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 253,
          "created_at": "2026-05-19T00:43:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 254,
          "created_at": "2026-05-19T00:43:30Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 255,
          "created_at": "2026-05-19T00:43:31Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 256,
          "created_at": "2026-05-19T00:43:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 257,
          "created_at": "2026-05-19T00:43:33Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 258,
          "created_at": "2026-05-19T00:43:34Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/cameronsjo/bosun",
    "host": "github.com",
    "name": "bosun",
    "owner": "cameronsjo"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 61,
      "inputs": {
        "security": 57,
        "vitality": 82,
        "community": 33,
        "governance": 54,
        "engineering": 76
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 82,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "commits_last_year": 934,
              "human_commit_share": 0.47,
              "days_since_last_push": 3,
              "active_weeks_last_year": 17
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 3 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "17/52 weeks with commits",
                "points": 11.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 17
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "934 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 934
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 95,
              "latest_release_tag": "v0.39.3",
              "releases_from_tags": false,
              "days_since_latest_release": 4,
              "mean_days_between_releases": 0.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "95 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 95
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 3,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 3 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 54,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 15,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.992
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 99% of commits",
                "points": 0.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 99
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "merged_prs": 264,
              "open_issues": 81,
              "closed_issues": 101,
              "issue_closed_ratio": 0.555,
              "closed_unmerged_prs": 17
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "56% of issues closed",
                "points": 25.9,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 56
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "264/281 decided PRs merged",
                "points": 35.9,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 264,
                      "decided": 281
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/12 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 55,
            "inputs": {
              "followers": 16,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "cameronsjo",
              "public_repos": 73,
              "account_age_days": 4856
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "16 followers of cameronsjo",
                "points": 8.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 16,
                      "login": "cameronsjo"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "73 public repos, account ~13 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 73
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 13
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/cameronsjo/bosun"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 4
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 4 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "95 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 95
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 76,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "6 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml, eslint.config.js",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml, eslint.config.js"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "14 out of 21 merged PRs checked by a CI test -- score normalized to 6",
                "points": 12,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 57,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 49,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 4.9
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "14 out of 21 merged PRs checked by a CI test -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/12 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "5 existing vulnerabilities detected",
                "points": 3.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 421 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 421
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 89,
            "inputs": {
              "source": "osv",
              "advisories": 5,
              "affected_packages": 5,
              "assessed_packages": 421,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, high 1, low 1, unknown 2",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: golang.org/x/crypto v0.53.0 (unknown)",
                "points": 26.6,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "golang.org/x/crypto v0.53.0 (unknown)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 421,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "excellent",
        "name": "AI Readiness",
        "value": 87,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "has_llms_txt": true,
              "legible_history_share": 1,
              "agent_instruction_files": [
                ".clinerules",
                ".cursorrules",
                ".github/copilot-instructions.md",
                ".windsurfrules",
                "AGENTS.md",
                "CLAUDE.md",
                "GEMINI.md",
                "openspec/AGENTS.md"
              ],
              "agent_instruction_max_bytes": 27289
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": ".clinerules, .cursorrules, .github/copilot-instructions.md, .windsurfrules, AGENTS.md, CLAUDE.md, GEMINI.md, openspec/AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".clinerules, .cursorrules, .github/copilot-instructions.md, .windsurfrules, AGENTS.md, CLAUDE.md, GEMINI.md, openspec/AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": "llms.txt present",
                "points": 15,
                "status": "met",
                "details": [
                  {
                    "code": "llms_txt_present",
                    "params": {}
                  }
                ],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "47 of 47 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 47,
                      "sampled": 47
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 91,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json",
                "pnpm-lock.yaml",
                "uv.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "webui/tsconfig.json"
              ],
              "agent_commit_share": 0.37,
              "toolchain_manifests": [
                "dagger/go.mod",
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.09
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml, eslint.config.js",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml, eslint.config.js"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "webui/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "webui/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "37 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 37,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "9 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 9,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 186708,
              "source_files_sampled": 253,
              "oversized_source_files": 5
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "5/253 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 253,
                      "oversized": 5
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T19:22:06.535546Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/cameronsjo/bosun.svg",
  "full_name": "cameronsjo/bosun",
  "license_state": "standard",
  "license_spdx": "MIT"
}

Related records

Inspected repositories sharing catalogue tags or ecosystems with cameronsjo/bosun. Read them side by side →

93apache/airflowApache Airflow - A platform to programmatically author, schedule, and monitor workflowsExcellent91authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™Excellent91hashicorp/consulConsul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.Excellent91coder/coderSecure environments for developers and their agentsExcellent90mattermost/mattermostMattermost is an open source platform for secure collaboration across the entire software development lifecycle..Excellent89Gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.Excellent

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — Go.