Public record
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-24 14:08 UTC

pomerium / ingress-controller

Pomerium Kubernetes Ingress Controller

GoApache-2.0★ 35 stars⑂ 22 forkssince Aug 2021View on GitHub ↗
#pomerium#kubernetes#ingress-controller

pomerium/ingress-controller holds a health index of 80 out of 100, placing it in the Good band. It scores highest on Vitality (98/100) and lowest on Community & Adoption (47/100). It was last updated today. 2 contributors account for most of its recent work.

80
overall / 100
Good

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

80
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
VitalityCommunity &AdoptionSustainability &GovernanceEngineeringQualitySecurityAI Readiness

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

Ownership

PomeriumOrganization
134 followers52 public repossince Dec 2018

This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.

Package ecosystems

RegistryPackageVersionDownloads / moVersionsLast publish
Gogithub.com/pomerium/ingress-controllerv0.33.0-647 days ago

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

98Excellent · 22% of overall

Development activity

97Excellent
How it's scored
36/36Push recency — last push 0 days ago
33.2/36Commit cadence — 48/52 weeks with commits
18/18Commit volume — 220 commits in the last year
10/10OpenSSF Scorecard: Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Inputs used
commits_last_year220
human_commit_share0.81
days_since_last_push0
active_weeks_last_year48

Release discipline

100Excellent
How it's scored
27/27Ships releases — 64 releases published
36/36Release recency — latest release 7 days ago
27/27Release cadence — a release every ~16.6 days
0/10OpenSSF Scorecard: Signed-Releases — no data
Inputs used
releases_count64
latest_release_tagv0.33.0
releases_from_tagsno
days_since_latest_release7
mean_days_between_releases16.6
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

47At risk · 18% of overall

Popularity & adoption

39At risk
How it's scored
24.8/60Stars — 35 stars
11/25Forks — 22 forks
3.3/15Watchers — 5 watchers
Inputs used
forks22
stars35
watchers5
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Community health

57Moderate
How it's scored
22.5/22.5README
22.5/22.5License — recognized license (Apache-2.0)
0/18CONTRIBUTING guide
0/13.5Code of conduct
0/7.2Issue template
6.3/6.3PR template
Inputs used
has_readmeyes
has_licenseyes
has_contributingno
has_issue_templateno
has_code_of_conductno
has_pull_request_templateyes

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

77Good · 24% of overall

Maintainer resilience (bus factor)

62Moderate
How it's scored
25.2/54Bus factor — 2 contributor(s) cover half of all commits
13.6/22.5Commit distribution — top contributor authored 40% of commits
13.5/13.5Contributor breadth — 17 contributors
10/10OpenSSF Scorecard: Contributors — project has 6 contributing companies or organizations
Inputs used
bus_factor2
contributors_sampled17
top_contributor_share0.397

Issue & PR responsiveness

83Good
How it's scored
36.5/46.8Issue resolution — 78% of issues closed
31.5/38.3PR acceptance — 1,082/1,315 decided PRs merged
15/15OpenSSF Scorecard: Code-Review — all changesets reviewed
Inputs used
merged_prs1,082
open_issues33
closed_issues117
issue_closed_ratio0.78
closed_unmerged_prs233

Ownership & stewardship

70Good
How it's scored
30/30Ownership backing — organization-owned
0/20Verified domain
15.3/25Owner reach — 134 followers of pomerium
24.6/25Track record — 52 public repos, account ~7 yr old
Inputs used
followers134
owner_typeOrganization
is_verified—
owner_loginpomerium
public_repos52
account_age_days2,771

Package maintenance

100Excellent
How it's scored
25/25Published & resolvable — 1 package(s) on go
35/35Publish recency — latest publish 7 days ago
20/20Version history — 64 published versions
20/20Not deprecated — active, not deprecated or yanked
Inputs used
packagesgithub.com/pomerium/ingress-controller
ecosystemsgo
any_deprecatedno
min_days_since_publish7

Engineering Quality

Are baseline engineering and documentation practices in place?

92Excellent · 20% of overall

Engineering practices

94Excellent
How it's scored
24/24CI workflows — 10 workflow(s)
24/24Tests present
16/16Linter config — .golangci.yml
9.6/9.6Pre-commit hooks
0/6.4.editorconfig
20/20OpenSSF Scorecard: CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Inputs used
has_ciyes
has_testsyes
has_editorconfigno
has_linter_configyes
has_precommit_configyes

Documentation

90Excellent
How it's scored
30/30README
25/25Documentation directory
15/15Documentation / homepage site — https://pomerium.com
10/10Repository description
10/10Topics — 3 topics
0/10Wiki
Inputs used
topicspomerium, kubernetes, ingress-controller
has_wikino
homepagehttps://pomerium.com
has_readmeyes
has_docs_diryes
has_descriptionyes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

80Good · 16% of overall

Security posture

75Good
How it's scored
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — no data
2.5/2.5CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
7.5/7.5Code-Review — all changesets reviewed
2.5/2.5Contributors — project has 6 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5License — license file detected
7.5/7.5Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
5/5Packaging — packaging workflow detected
4/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 8
5/5SAST — SAST tool is run on all commits
0/5Security-Policy — security policy file not detected
0/7.5Signed-Releases — no data
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
6/7.5Vulnerabilities — 2 existing vulnerabilities detected
Inputs used
sourceopenssf_scorecard
checks_evaluated16
scorecard_versionv5.5.0
checks_inconclusive2
scorecard_aggregate7.5
Excluded from scoring (no data or not applicable): branch_protection, signed_releases. Remaining weights renormalized.

Dependency advisories

100Excellent
How it's scored
35/35Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40No advisories left outstanding — no advisory carries a publication date
Inputs used
sourceosv
advisories2
affected_packages2
assessed_packages338
unassessed_packages0
affected_by_severityhigh 1, unknown 1
direct_affected_packages0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 338 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

73Good · 0% of overall

Agent context & guidance

40At risk
How it's scored
0/45Agent instructions — no CLAUDE.md / AGENTS.md / editor rules
0/15Machine-readable docs (llms.txt)
40/40Legible commit history — 81 of 81 human commits state their intent (structured subject or explanatory body)
Inputs used
has_llms_txtno
legible_history_share1
agent_instruction_files—
agent_instruction_max_bytes—

Verify loop (build / test / typecheck)

88Excellent
How it's scored
18/18One-command bootstrap — Makefile
22/22Automated tests
11/11Lint / format config — .golangci.yml
11/11Static type checking — Go (statically typed)
10/10Reproducible environment — Dockerfile, lockfile
0/10Demonstrated agent practice — no agent-authored commits among the last 100
8/8Automated maintenance — 19 of the last 100 commits are automated dependency updates
8/10OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 8
Inputs used
has_nixno
has_testsyes
lockfilesgo.sum
has_dockerfileyes
typed_languageyes
bootstrap_filesMakefile
has_devcontainerno
has_linter_configyes
typecheck_configs—
agent_commit_share0
toolchain_manifestsgo.mod
dependency_bot_commit_share0.19

Code legibility for models

100Excellent
How it's scored
45/45Type-checkable code — Go (statically typed)
54.6/55Manageable file sizes — 1/143 source files over 60KB
Inputs used
primary_languageGo
largest_source_bytes67,498
source_files_sampled143
oversized_source_files1

Key facts

35GitHub stars
17contributors
220commits, last 12 months
0days since last push
64releases
2bus factor
33open issues
Gopackage ecosystems

Data collection warnings

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token

More detail

Star and fork history 0 ★ / 22 ⇿
0Stars
22Forks
57Releases

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

048121620242212022-042024-062026-07
Major 0Minor 15Patch 41

Each point covers 4 days.

OpenSSF Scorecard 7.5 / 10
7.5aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-24 14:08 UTC

10Binary-Artifactsno binaries found in the repo
n/aBranch-Protectioninternal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
10CI-Tests30 out of 30 merged PRs checked by a CI test -- score normalized to 10
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
10Code-Reviewall changesets reviewed
10Contributorsproject has 6 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
10Packagingpackaging workflow detected
8Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 8
10SASTSAST tool is run on all commits
0Security-Policysecurity policy file not detected
n/aSigned-Releasesno releases found
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
8Vulnerabilities2 existing vulnerabilities detected
Direct dependencies 41
RegistryPackageVersion constraintManifest
Goconnectrpc.com/connectv1.20.0go.mod
Gogithub.com/cenkalti/backoff/v4v4.3.0go.mod
Gogithub.com/cert-manager/cert-managerv1.20.3go.mod
Gogithub.com/envoyproxy/go-control-plane/envoyv1.37.0go.mod
Gogithub.com/go-logr/logrv1.4.3go.mod
Gogithub.com/go-logr/zaprv1.3.0go.mod
Gogithub.com/go-playground/validator/v10v10.30.3go.mod
Gogithub.com/google/go-cmpv0.7.0go.mod
Gogithub.com/google/uuidv1.6.0go.mod
Gogithub.com/gosimple/slugv1.15.0go.mod
Gogithub.com/hashicorp/go-multierrorv1.1.1go.mod
Gogithub.com/hashicorp/go-set/v3v3.0.1go.mod
Gogithub.com/iancoleman/strcasev0.3.0go.mod
Gogithub.com/martinlindhe/base36v1.1.1go.mod
Gogithub.com/open-policy-agent/opav1.18.1go.mod
Gogithub.com/pomerium/pomeriumv0.32.5-rc.1.0.20260722011640-c0fe8baec82fgo.mod
Gogithub.com/pomerium/pomerium/pkg/grpc/configv0.0.0-20260722011640-c0fe8baec82fgo.mod
Gogithub.com/pomerium/pomerium/pkg/grpc/databrokerv0.0.0-20260722011640-c0fe8baec82fgo.mod
Gogithub.com/pomerium/sdk-gov0.0.10-0.20260717162757-c07b754ff8f0go.mod
Gogithub.com/rs/zerologv1.35.1go.mod
Gogithub.com/sergi/go-diffv1.4.0go.mod
Gogithub.com/spf13/cobrav1.10.2go.mod
Gogithub.com/spf13/pflagv1.0.10go.mod
Gogithub.com/spf13/viperv1.21.0go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogithub.com/volatiletech/null/v9v9.0.0go.mod
Gogo.opentelemetry.io/otel/tracev1.44.0go.mod
Gogo.uber.org/mockv0.6.0go.mod
Gogo.uber.org/zapv1.28.0go.mod
Gogolang.org/x/netv0.57.0go.mod
Gogolang.org/x/syncv0.22.0go.mod
Gogoogle.golang.org/grpcv1.82.1go.mod
Gogoogle.golang.org/protobufv1.36.12-0.20260120151049-f2248ac996afgo.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
Gok8s.io/apiv0.36.2go.mod
Gok8s.io/apiextensions-apiserverv0.36.2go.mod
Gok8s.io/apimachineryv0.36.2go.mod
Gok8s.io/apiserverv0.36.2go.mod
Gok8s.io/client-gov0.36.2go.mod
Gosigs.k8s.io/controller-runtimev0.24.1go.mod
Gosigs.k8s.io/gateway-apiv1.6.0go.mod
All dependencies 338

Full resolved dependency set from the GitHub dependency graph: 41 direct and 297 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

RegistryPackageVersionRelation
Goconnectrpc.com/connectv1.20.0direct
Gogithub.com/cenkalti/backoff/v4v4.3.0direct
Gogithub.com/cert-manager/cert-managerv1.20.3direct
Gogithub.com/envoyproxy/go-control-plane/envoyv1.37.0direct
Gogithub.com/go-logr/logrv1.4.3direct
Gogithub.com/go-logr/zaprv1.3.0direct
Gogithub.com/go-playground/validator/v10v10.30.3direct
Gogithub.com/google/go-cmpv0.7.0direct
Gogithub.com/google/uuidv1.6.0direct
Gogithub.com/gosimple/slugv1.15.0direct
Gogithub.com/hashicorp/go-multierrorv1.1.1direct
Gogithub.com/hashicorp/go-set/v3v3.0.1direct
Gogithub.com/iancoleman/strcasev0.3.0direct
Gogithub.com/martinlindhe/base36v1.1.1direct
Gogithub.com/open-policy-agent/opav1.18.1direct
Gogithub.com/pomerium/pomeriumv0.32.5-rc.1.0.20260722011640-c0fe8baec82fdirect
Gogithub.com/pomerium/pomerium/pkg/grpc/configv0.0.0-20260722011640-c0fe8baec82fdirect
Gogithub.com/pomerium/pomerium/pkg/grpc/databrokerv0.0.0-20260722011640-c0fe8baec82fdirect
Gogithub.com/pomerium/sdk-gov0.0.10-0.20260717162757-c07b754ff8f0direct
Gogithub.com/rs/zerologv1.35.1direct
Gogithub.com/sergi/go-diffv1.4.0direct
Gogithub.com/spf13/cobrav1.10.2direct
Gogithub.com/spf13/pflagv1.0.10direct
Gogithub.com/spf13/viperv1.21.0direct
Gogithub.com/stretchr/testifyv1.11.1direct
Gogithub.com/volatiletech/null/v9v9.0.0direct
Gogo.opentelemetry.io/otel/tracev1.44.0direct
Gogo.uber.org/mockv0.6.0direct
Gogo.uber.org/zapv1.28.0direct
Gogolang.org/x/netv0.57.0direct
Gogolang.org/x/syncv0.22.0direct
Gogoogle.golang.org/grpcv1.82.1direct
Gogoogle.golang.org/protobufv1.36.12-0.20260120151049-f2248ac996afdirect
Gogopkg.in/yaml.v3v3.0.1direct
Gok8s.io/apiv0.36.2direct
Gok8s.io/apiextensions-apiserverv0.36.2direct
Gok8s.io/apimachineryv0.36.2direct
Gok8s.io/apiserverv0.36.2direct
Gok8s.io/client-gov0.36.2direct
Gosigs.k8s.io/controller-runtimev0.24.1direct
Gosigs.k8s.io/gateway-apiv1.6.0direct
Gobuf.build/gen/go/bufbuild/protovalidate/protocolbuffers/gov1.36.11-20260415201107-50325440f8f2.1indirect
Gobuf.build/go/protovalidatev1.2.0indirect
Gocel.dev/exprv0.25.2indirect
Gocharm.land/bubbles/v2v2.1.0indirect
Gocharm.land/bubbletea/v2v2.0.7indirect
Gocharm.land/lipgloss/v2v2.0.4indirect
Gocloud.google.com/gov0.123.0indirect
Gocloud.google.com/go/authv0.20.0indirect
Gocloud.google.com/go/auth/oauth2adaptv0.2.8indirect
Gocloud.google.com/go/compute/metadatav0.9.0indirect
Gocloud.google.com/go/iamv1.5.3indirect
Gocloud.google.com/go/monitoringv1.24.3indirect
Gocloud.google.com/go/storagev1.61.3indirect
Goconnectrpc.com/grpchealthv1.4.0indirect
Goconnectrpc.com/grpcreflectv1.3.0indirect
Goconnectrpc.com/otelconnectv0.9.0indirect
Gocontrib.go.opencensus.io/exporter/prometheusv0.4.2indirect
Gofilippo.io/bigmodv0.0.3indirect
Gofilippo.io/csrfv0.2.1indirect
Gofilippo.io/keygenv0.0.0-20250626140535-790df0a991a0indirect
Gogithub.com/agnivade/levenshteinv1.2.1indirect
Gogithub.com/andybalholm/brotliv1.1.0indirect
Gogithub.com/antlr4-go/antlr/v4v4.13.1indirect
Gogithub.com/apapsch/go-jsonmerge/v2v2.0.0indirect
Gogithub.com/armon/go-metricsv0.4.1indirect
Gogithub.com/atotto/clipboardv0.1.4indirect
Gogithub.com/aws/aws-sdk-go-v2v1.42.1indirect
Gogithub.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.11indirect
Gogithub.com/aws/aws-sdk-go-v2/configv1.32.27indirect
Gogithub.com/aws/aws-sdk-go-v2/credentialsv1.19.26indirect
Gogithub.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.30indirect
Gogithub.com/aws/aws-sdk-go-v2/feature/s3/managerv1.20.12indirect
Gogithub.com/aws/aws-sdk-go-v2/feature/s3/transfermanagerv0.2.3indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.30indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.30indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/v4av1.4.31indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.13indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/checksumv1.9.18indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.30indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/s3sharedv1.19.25indirect
Gogithub.com/aws/aws-sdk-go-v2/service/s3v1.102.2indirect
Gogithub.com/aws/aws-sdk-go-v2/service/signinv1.2.2indirect
Gogithub.com/aws/aws-sdk-go-v2/service/ssov1.31.5indirect
Gogithub.com/aws/aws-sdk-go-v2/service/ssooidcv1.36.8indirect
Gogithub.com/aws/aws-sdk-go-v2/service/stsv1.43.5indirect
Gogithub.com/aws/smithy-gov1.27.3indirect
Gogithub.com/aymanbagabas/go-osc52/v2v2.0.1indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/azcorev1.21.0indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/azidentityv1.13.1indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/internalv1.11.2indirect
Gogithub.com/azure/azure-sdk-for-go/sdk/storage/azblobv1.6.4indirect
Gogithub.com/azuread/microsoft-authentication-library-for-gov1.7.0indirect
Gogithub.com/beorn7/perksv1.0.1indirect
Gogithub.com/bits-and-blooms/bitsetv1.24.4indirect
Gogithub.com/blang/semver/v4v4.0.0indirect
Gogithub.com/caddyserver/certmagicv0.25.2indirect
Gogithub.com/caddyserver/zerosslv0.1.5indirect
Gogithub.com/cafxx/httpcompressionv0.0.9indirect
Gogithub.com/ccoveille/go-safecast/v2v2.0.1indirect
Gogithub.com/cenkalti/backoff/v5v5.0.3indirect
Gogithub.com/cespare/xxhash/v2v2.3.0indirect
Gogithub.com/charmbracelet/colorprofilev0.4.3indirect
Gogithub.com/charmbracelet/ultravioletv0.0.0-20260525132238-948f4557a654indirect
Gogithub.com/charmbracelet/x/ansiv0.11.7indirect
Gogithub.com/charmbracelet/x/termv0.2.2indirect
Gogithub.com/charmbracelet/x/termiosv0.1.1indirect
Gogithub.com/charmbracelet/x/windowsv0.2.2indirect
Gogithub.com/clipperhouse/displaywidthv0.11.0indirect
Gogithub.com/clipperhouse/uax29/v2v2.7.0indirect
Gogithub.com/cloudflare/circlv1.6.3indirect
Gogithub.com/cncf/xds/gov0.0.0-20260202195803-dba9d589def2indirect
Gogithub.com/cockroachdb/crlibv0.0.0-20241112164430-1264a2edc35bindirect
Gogithub.com/cockroachdb/errorsv1.11.3indirect
Gogithub.com/cockroachdb/logtagsv0.0.0-20230118201751-21c54148d20bindirect
Gogithub.com/cockroachdb/pebble/v2v2.1.4indirect
Gogithub.com/cockroachdb/redactv1.1.5indirect
Gogithub.com/cockroachdb/swissv0.0.0-20251224182025-b0f6560f979bindirect
Gogithub.com/cockroachdb/tokenbucketv0.0.0-20230807174530-cc333fc44b06indirect
Gogithub.com/coreos/go-oidc/v3v3.19.0indirect
Gogithub.com/datadog/zstdv1.5.7indirect
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccindirect
Gogithub.com/decred/dcrd/dcrec/secp256k1/v4v4.4.1indirect
Gogithub.com/emicklei/go-restful/v3v3.13.0indirect
Gogithub.com/envoyproxy/go-control-planev0.14.0indirect
Gogithub.com/envoyproxy/protoc-gen-validatev1.3.3indirect
Gogithub.com/evanphx/json-patch/v5v5.9.11indirect
Gogithub.com/exaring/otelpgxv0.10.0indirect
Gogithub.com/fatih/colorv1.18.0indirect
Gogithub.com/felixge/httpsnoopv1.0.4indirect
Gogithub.com/fsnotify/fsnotifyv1.10.1indirect
Gogithub.com/fxamacker/cbor/v2v2.9.2indirect
Gogithub.com/gabriel-vasile/mimetypev1.4.13indirect
Gogithub.com/gaissmai/bartv0.26.1indirect
Gogithub.com/getsentry/sentry-gov0.27.0indirect
Gogithub.com/go-chi/chi/v5v5.3.0indirect
Gogithub.com/go-jose/go-jose/v3v3.0.5indirect
Gogithub.com/go-jose/go-jose/v4v4.1.4indirect
Gogithub.com/go-kit/logv0.2.1indirect
Gogithub.com/go-logfmt/logfmtv0.6.0indirect
Gogithub.com/go-logr/stdrv1.2.2indirect
Gogithub.com/go-ole/go-olev1.3.0indirect
Gogithub.com/go-openapi/jsonpointerv0.23.1indirect
Gogithub.com/go-openapi/jsonreferencev0.21.5indirect
Gogithub.com/go-openapi/swagv0.26.0indirect
Gogithub.com/go-openapi/swag/cmdutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/convv0.26.0indirect
Gogithub.com/go-openapi/swag/fileutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/jsonnamev0.26.0indirect
Gogithub.com/go-openapi/swag/jsonutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/loadingv0.26.0indirect
Gogithub.com/go-openapi/swag/manglingv0.26.0indirect
Gogithub.com/go-openapi/swag/netutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/stringutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/typeutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/yamlutilsv0.26.0indirect
Gogithub.com/go-playground/localesv0.14.1indirect
Gogithub.com/go-playground/universal-translatorv0.18.1indirect
Gogithub.com/go-viper/mapstructure/v2v2.5.0indirect
Gogithub.com/gobwas/globv0.2.3indirect
Gogithub.com/goccy/go-jsonv0.10.6indirect
Gogithub.com/gogo/protobufv1.3.2indirect
Gogithub.com/golang-jwt/jwt/v5v5.3.1indirect
Gogithub.com/golang/groupcachev0.0.0-20241129210726-2c02b8208cf8indirect
Gogithub.com/golang/snappyv1.0.0indirect
Gogithub.com/google/btreev1.1.3indirect
Gogithub.com/google/cel-gov0.28.1indirect
Gogithub.com/google/gnosticv0.7.2-0.20250814192921-e0e09f706281indirect
Gogithub.com/google/gnostic-modelsv0.7.1indirect
Gogithub.com/google/go-tpmv0.9.8indirect
Gogithub.com/google/s2a-gov0.1.9indirect
Gogithub.com/google/wirev0.7.0indirect
Gogithub.com/googleapis/enterprise-certificate-proxyv0.3.17indirect
Gogithub.com/googleapis/gax-go/v2v2.22.0indirect
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcpv1.32.0indirect
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/exporter/metricv0.55.0indirect
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemappingv0.55.0indirect
Gogithub.com/gorilla/muxv1.8.1indirect
Gogithub.com/gorilla/securecookiev1.1.2indirect
Gogithub.com/gosimple/unidecodev1.0.1indirect
Gogithub.com/gregjones/httpcachev0.0.0-20190611155906-901d90724c79indirect
Gogithub.com/grpc-ecosystem/grpc-gateway/v2v2.29.0indirect
Gogithub.com/hashicorp/errwrapv1.1.0indirect
Gogithub.com/hashicorp/go-hclogv1.6.2indirect
Gogithub.com/hashicorp/go-immutable-radixv1.0.0indirect
Gogithub.com/hashicorp/go-metricsv0.5.4indirect
Gogithub.com/hashicorp/go-msgpack/v2v2.1.2indirect
Gogithub.com/hashicorp/golang-lruv0.5.1indirect
Gogithub.com/hashicorp/golang-lru/v2v2.0.7indirect
Gogithub.com/hashicorp/raftv1.7.3indirect
Gogithub.com/inconshreveable/mousetrapv1.1.0indirect
Gogithub.com/jackc/pgpassfilev1.0.0indirect
Gogithub.com/jackc/pgservicefilev0.0.0-20240606120523-5a60cdf6a761indirect
Gogithub.com/jackc/pgx/v5v5.9.2indirect
Gogithub.com/jackc/puddle/v2v2.2.2indirect
Gogithub.com/json-iterator/gov1.1.12indirect
Gogithub.com/jxskiss/base62v1.1.0indirect
Gogithub.com/klauspost/compressv1.19.0indirect
Gogithub.com/klauspost/cpuid/v2v2.3.0indirect
Gogithub.com/kr/prettyv0.3.1indirect
Gogithub.com/kr/textv0.2.0indirect
Gogithub.com/kylelemons/godebugv1.1.0indirect
Gogithub.com/leodido/go-urnv1.4.0indirect
Gogithub.com/lestrrat-go/blackmagicv1.0.4indirect
Gogithub.com/lestrrat-go/dsigv1.2.1indirect
Gogithub.com/lestrrat-go/dsig-secp256k1v1.0.0indirect
Gogithub.com/lestrrat-go/httpccv1.0.1indirect
Gogithub.com/lestrrat-go/httprc/v3v3.0.5indirect
Gogithub.com/lestrrat-go/jwx/v3v3.1.1indirect
Gogithub.com/lestrrat-go/option/v2v2.0.0indirect
Gogithub.com/libdns/libdnsv1.1.1indirect
Gogithub.com/libp2p/go-reuseportv0.4.0indirect
Gogithub.com/lucasb-eyer/go-colorfulv1.4.0indirect
Gogithub.com/lufia/plan9statsv0.0.0-20240513124658-fba389f38baeindirect
Gogithub.com/masterminds/semver/v3v3.5.0indirect
Gogithub.com/mattn/go-colorablev0.1.14indirect
Gogithub.com/mattn/go-isattyv0.0.22indirect
Gogithub.com/mattn/go-runewidthv0.0.23indirect
Gogithub.com/mholt/acmez/v3v3.1.6indirect
Gogithub.com/miekg/dnsv1.1.72indirect
Gogithub.com/minio/minlzv1.0.1-0.20250507153514-87eb42fe8882indirect
Gogithub.com/mitchellh/hashstructure/v2v2.0.2indirect
Gogithub.com/modelcontextprotocol/go-sdkv1.5.0indirect
Gogithub.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1ddindirect
Gogithub.com/modern-go/reflect2v1.0.3-0.20250322232337-35a7c28c31eeindirect
Gogithub.com/muesli/cancelreaderv0.2.2indirect
Gogithub.com/muesli/termenvv0.16.0indirect
Gogithub.com/munnerz/goautonegv0.0.0-20191010083416-a7dc8b61c822indirect
Gogithub.com/natefinch/atomicv1.0.1indirect
Gogithub.com/nxadm/tailv1.4.8indirect
Gogithub.com/oapi-codegen/runtimev1.6.0indirect
Gogithub.com/opencontainers/go-digestv1.0.0indirect
Gogithub.com/opencontainers/image-specv1.1.1indirect
Gogithub.com/pelletier/go-toml/v2v2.2.4indirect
Gogithub.com/pires/go-proxyprotov0.11.0indirect
Gogithub.com/pkg/browserv0.0.0-20240102092130-5ac0b6a4141cindirect
Gogithub.com/pkg/errorsv0.9.1indirect
Gogithub.com/planetscale/vtprotobufv0.6.1-0.20240319094008-0393e58bdf10indirect
Gogithub.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2indirect
Gogithub.com/pomerium/datasourcev0.18.2-0.20260716182004-1c5ab56d78c6indirect
Gogithub.com/pomerium/envoy-customv1.37.0-rc3.0.20260618180819-16ede7a56f2findirect
Gogithub.com/pomerium/protoutilv0.0.0-20260712023948-476583c4c434indirect
Gogithub.com/pomerium/webauthnv0.0.0-20260712023900-f47fcf774920indirect
Gogithub.com/power-devops/perfstatv0.0.0-20240221224432-82ca36839d55indirect
Gogithub.com/prometheus/client_golangv1.23.2indirect
Gogithub.com/prometheus/client_modelv0.6.2indirect
Gogithub.com/prometheus/commonv0.67.5indirect
Gogithub.com/prometheus/otlptranslatorv1.0.0indirect
Gogithub.com/prometheus/procfsv0.20.1indirect
Gogithub.com/prometheus/statsd_exporterv0.22.7indirect
Gogithub.com/raduberinde/axisdsv0.1.0indirect
Gogithub.com/raduberinde/btreemapv0.0.0-20250419174037-3d62b7205d54indirect
Gogithub.com/rcrowley/go-metricsv0.0.0-20250401214520-65e299d6c5c9indirect
Gogithub.com/rivo/unisegv0.4.7indirect
Gogithub.com/rogpeppe/go-internalv1.15.0indirect
Gogithub.com/rs/corsv1.11.1indirect
Gogithub.com/sagikazarmark/locaferov0.11.0indirect
Gogithub.com/sahilm/fuzzyv0.1.1indirect
Gogithub.com/segmentio/asmv1.2.1indirect
Gogithub.com/segmentio/encodingv0.5.4indirect
Gogithub.com/shirou/gopsutil/v3v3.24.5indirect
Gogithub.com/shoenig/go-m1cpuv0.1.6indirect
Gogithub.com/shogo82148/go-sfvv0.3.3indirect
Gogithub.com/sirupsen/logrusv1.9.4indirect
Gogithub.com/sourcegraph/concv0.3.1-0.20240121214520-5f936abd7ae8indirect
Gogithub.com/spf13/aferov1.15.0indirect
Gogithub.com/spf13/castv1.10.0indirect
Gogithub.com/spiffe/go-spiffe/v2v2.6.0indirect
Gogithub.com/subosito/gotenvv1.6.0indirect
Gogithub.com/tchap/go-patricia/v2v2.3.3indirect
Gogithub.com/tidwall/prettyv1.2.1indirect
Gogithub.com/tklauser/go-sysconfv0.3.16indirect
Gogithub.com/tklauser/numcpusv0.11.0indirect
Gogithub.com/tniswong/go.rfcxv0.0.0-20181019234604-07783c52761findirect
Gogithub.com/valyala/fastjsonv1.6.10indirect
Gogithub.com/vektah/gqlparser/v2v2.5.36indirect
Gogithub.com/victoriametrics/fastcachev1.13.3indirect
Gogithub.com/weastur/hclog-zerologv1.0.0indirect
Gogithub.com/x448/float16v0.8.4indirect
Gogithub.com/xeipuuv/gojsonpointerv0.0.0-20190905194746-02993c407bfbindirect
Gogithub.com/xeipuuv/gojsonreferencev0.0.0-20180127040603-bd5ef7bd5415indirect
Gogithub.com/xo/terminfov0.0.0-20220910002029-abceb7e1c41eindirect
Gogithub.com/yashtewari/glob-intersectionv0.2.0indirect
Gogithub.com/yusufpapurcu/wmiv1.2.4indirect
Gogithub.com/zeebo/blake3v0.2.4indirect
Gogithub.com/zeebo/xxh3v1.1.0indirect
Gogo.opencensus.iov0.24.0indirect
Gogo.opentelemetry.io/auto/sdkv1.2.1indirect
Gogo.opentelemetry.io/contrib/detectors/gcpv1.43.0indirect
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.68.0indirect
Gogo.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.69.0indirect
Gogo.opentelemetry.io/contrib/propagators/autopropv0.68.0indirect
Gogo.opentelemetry.io/contrib/propagators/awsv1.43.0indirect
Gogo.opentelemetry.io/contrib/propagators/b3v1.43.0indirect
Gogo.opentelemetry.io/contrib/propagators/jaegerv1.43.0indirect
Gogo.opentelemetry.io/contrib/propagators/otv1.43.0indirect
Gogo.opentelemetry.io/otelv1.44.0indirect
Gogo.opentelemetry.io/otel/exporters/otlp/otlptracev1.44.0indirect
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpcv1.44.0indirect
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.44.0indirect
Gogo.opentelemetry.io/otel/exporters/prometheusv0.65.0indirect
Gogo.opentelemetry.io/otel/metricv1.44.0indirect
Gogo.opentelemetry.io/otel/sdkv1.44.0indirect
Gogo.opentelemetry.io/otel/sdk/metricv1.44.0indirect
Gogo.opentelemetry.io/proto/otlpv1.10.0indirect
Gogo.uber.org/automaxprocsv1.6.0indirect
Gogo.uber.org/multierrv1.11.0indirect
Gogo.uber.org/zap/expv0.3.0indirect
Gogo.yaml.in/yaml/v2v2.4.4indirect
Gogo.yaml.in/yaml/v3v3.0.4indirect
Gogocloud.devv0.46.0indirect
Gogolang.org/x/cryptov0.54.0indirect
Gogolang.org/x/expv0.0.0-20260508232706-74f9aab9d74aindirect
Gogolang.org/x/modv0.37.0indirect
Gogolang.org/x/oauth2v0.36.0indirect
Gogolang.org/x/sysv0.47.0indirect
Gogolang.org/x/termv0.45.0indirect
Gogolang.org/x/textv0.40.0indirect
Gogolang.org/x/timev0.15.0indirect
Gogolang.org/x/toolsv0.47.0indirect
Gogolang.org/x/xerrorsv0.0.0-20240903120638-7835f813f4daindirect
Gogomodules.xyz/jsonpatch/v2v2.5.0indirect
Gogoogle.golang.org/apiv0.287.0indirect
Gogoogle.golang.org/genprotov0.0.0-20260319201613-d00831a3d3e7indirect
Gogoogle.golang.org/genproto/googleapis/apiv0.0.0-20260720211330-0afa2a65878aindirect
Gogoogle.golang.org/genproto/googleapis/rpcv0.0.0-20260720211330-0afa2a65878aindirect
Gogopkg.in/evanphx/json-patch.v4v4.13.0indirect
Gogopkg.in/inf.v0v0.9.1indirect
Gogopkg.in/yaml.v2v2.4.0indirect
Gok8s.io/component-basev0.36.2indirect
Gok8s.io/klog/v2v2.140.0indirect
Gok8s.io/kube-openapiv0.0.0-20260501160325-927ab1f70cd6indirect
Gok8s.io/utilsv0.0.0-20260319190234-28399d86e0b5indirect
Gooras.land/oras-go/v2v2.6.1indirect
Gosigs.k8s.io/jsonv0.0.0-20250730193827-2d320260d730indirect
Gosigs.k8s.io/randfillv1.0.0indirect
Gosigs.k8s.io/structured-merge-diff/v6v6.4.0indirect
Gosigs.k8s.io/yamlv1.6.0indirect
Dependency advisories 2

This repository publishes no package the index resolves, so its own dependency graph was assessed — 338 packages, which also include development and test pins that never ship: 2 carry known advisories, of which 0 are direct.

PackageVersionRelationSeverityAdvisoriesFixed in
oras.land/oras-go/v2v2.6.1indirecthigh1—
golang.org/x/cryptov0.54.0indirectunknown1—

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable
{
  "data": {
    "repo": {
      "topics": [
        "pomerium",
        "kubernetes",
        "ingress-controller"
      ],
      "is_fork": false,
      "size_kb": 4050,
      "has_wiki": false,
      "homepage": "https://pomerium.com",
      "languages": {
        "Go": 652376,
        "Shell": 4640,
        "Makefile": 8596,
        "Dockerfile": 339
      },
      "pushed_at": "2026-07-24T02:29:37Z",
      "created_at": "2021-08-11T20:12:35Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-22T02:52:38Z",
      "description": "Pomerium Kubernetes Ingress Controller",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://www.pomerium.com/",
      "name": "Pomerium",
      "type": "Organization",
      "login": "pomerium",
      "company": null,
      "location": "United States of America",
      "followers": 134,
      "avatar_url": "https://avatars.githubusercontent.com/u/46059110?v=4",
      "created_at": "2018-12-21T23:05:02Z",
      "is_verified": null,
      "public_repos": 52,
      "account_age_days": 2771
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.33.0",
          "kind": "minor",
          "published_at": "2026-07-16T19:35:18Z"
        },
        {
          "tag": "v0.32.9",
          "kind": "patch",
          "published_at": "2026-06-16T18:07:28Z"
        },
        {
          "tag": "v0.32.8",
          "kind": "patch",
          "published_at": "2026-05-07T22:00:39Z"
        },
        {
          "tag": "v0.32.7",
          "kind": "patch",
          "published_at": "2026-04-28T18:25:50Z"
        },
        {
          "tag": "v0.32.6",
          "kind": "patch",
          "published_at": "2026-04-08T22:07:20Z"
        },
        {
          "tag": "v0.32.5",
          "kind": "patch",
          "published_at": "2026-03-18T00:48:27Z"
        },
        {
          "tag": "v0.32.4",
          "kind": "patch",
          "published_at": "2026-03-17T18:31:12Z"
        },
        {
          "tag": "v0.32.3",
          "kind": "patch",
          "published_at": "2026-02-18T19:04:49Z"
        },
        {
          "tag": "v0.32.2",
          "kind": "patch",
          "published_at": "2026-02-17T20:55:32Z"
        },
        {
          "tag": "v0.32.1",
          "kind": "patch",
          "published_at": "2026-02-17T20:04:44Z"
        },
        {
          "tag": "v0.32.0",
          "kind": "minor",
          "published_at": "2026-01-21T19:30:52Z"
        },
        {
          "tag": "v0.31.3",
          "kind": "patch",
          "published_at": "2025-12-11T01:10:49Z"
        },
        {
          "tag": "v0.30.8",
          "kind": "patch",
          "published_at": "2025-12-11T00:59:41Z"
        },
        {
          "tag": "v0.31.2",
          "kind": "patch",
          "published_at": "2025-12-05T19:57:35Z"
        },
        {
          "tag": "v0.30.7",
          "kind": "patch",
          "published_at": "2025-10-24T16:59:37Z"
        },
        {
          "tag": "v0.31.1",
          "kind": "patch",
          "published_at": "2025-10-23T23:00:55Z"
        },
        {
          "tag": "v0.31.0",
          "kind": "minor",
          "published_at": "2025-10-14T20:45:48Z"
        },
        {
          "tag": "v0.30.6",
          "kind": "patch",
          "published_at": "2025-09-11T15:01:51Z"
        },
        {
          "tag": "v0.30.5",
          "kind": "patch",
          "published_at": "2025-08-20T12:41:23Z"
        },
        {
          "tag": "v0.30.4",
          "kind": "patch",
          "published_at": "2025-08-19T18:29:45Z"
        },
        {
          "tag": "v0.30.3",
          "kind": "patch",
          "published_at": "2025-07-16T23:18:10Z"
        },
        {
          "tag": "v0.29.6",
          "kind": "patch",
          "published_at": "2025-07-16T23:14:58Z"
        },
        {
          "tag": "v0.30.2",
          "kind": "patch",
          "published_at": "2025-07-14T15:19:36Z"
        },
        {
          "tag": "v0.30.1",
          "kind": "patch",
          "published_at": "2025-07-14T14:17:22Z"
        },
        {
          "tag": "v0.29.5",
          "kind": "patch",
          "published_at": "2025-07-14T15:24:14Z"
        },
        {
          "tag": "v0.30.0",
          "kind": "minor",
          "published_at": "2025-07-08T18:58:21Z"
        },
        {
          "tag": "v0.29.4",
          "kind": "patch",
          "published_at": "2025-05-22T22:55:34Z"
        },
        {
          "tag": "v0.29.3",
          "kind": "patch",
          "published_at": "2025-05-08T15:14:26Z"
        },
        {
          "tag": "v0.29.2",
          "kind": "patch",
          "published_at": "2025-04-01T16:45:24Z"
        },
        {
          "tag": "v0.29.1",
          "kind": "patch",
          "published_at": "2025-03-28T20:57:19Z"
        },
        {
          "tag": "v0.29.0",
          "kind": "minor",
          "published_at": "2025-03-26T18:50:09Z"
        },
        {
          "tag": "v0.28.0",
          "kind": "minor",
          "published_at": "2024-11-11T23:55:11Z"
        },
        {
          "tag": "v0.27.2",
          "kind": "patch",
          "published_at": "2024-10-22T21:56:29Z"
        },
        {
          "tag": "v0.27.1",
          "kind": "patch",
          "published_at": "2024-09-30T20:59:26Z"
        },
        {
          "tag": "v0.27.0",
          "kind": "minor",
          "published_at": "2024-09-10T14:31:44Z"
        },
        {
          "tag": "v0.26.2",
          "kind": "patch",
          "published_at": "2024-07-19T19:21:14Z"
        },
        {
          "tag": "v0.26.1",
          "kind": "patch",
          "published_at": "2024-07-01T23:31:00Z"
        },
        {
          "tag": "v0.26.0",
          "kind": "minor",
          "published_at": "2024-05-17T18:31:48Z"
        },
        {
          "tag": "v0.25.2",
          "kind": "patch",
          "published_at": "2024-04-05T20:28:03Z"
        },
        {
          "tag": "v0.25.1",
          "kind": "patch",
          "published_at": "2024-03-13T16:21:11Z"
        },
        {
          "tag": "v0.25.0",
          "kind": "minor",
          "published_at": "2024-01-10T21:24:12Z"
        },
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2023-11-16T22:15:50Z"
        },
        {
          "tag": "v0.23.1",
          "kind": "patch",
          "published_at": "2023-10-02T21:39:39Z"
        },
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2023-08-29T13:56:00Z"
        },
        {
          "tag": "v0.22.3",
          "kind": "patch",
          "published_at": "2023-08-22T13:54:30Z"
        },
        {
          "tag": "v0.20.1",
          "kind": "patch",
          "published_at": "2023-05-26T22:40:07Z"
        },
        {
          "tag": "v0.21.3",
          "kind": "patch",
          "published_at": "2023-05-26T22:26:38Z"
        },
        {
          "tag": "v0.22.2",
          "kind": "patch",
          "published_at": "2023-05-26T22:15:20Z"
        },
        {
          "tag": "v0.22.1",
          "kind": "patch",
          "published_at": "2023-05-10T00:42:12Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2023-05-03T17:50:19Z"
        },
        {
          "tag": "v0.21.2",
          "kind": "patch",
          "published_at": "2023-02-23T21:12:28Z"
        },
        {
          "tag": "v0.21.0-rc2",
          "kind": "prerelease",
          "published_at": "2023-01-31T14:25:05Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2022-11-22T21:26:18Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2022-11-03T17:59:18Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2022-07-27T20:29:21Z"
        },
        {
          "tag": "v0.17.3",
          "kind": "patch",
          "published_at": "2022-05-17T15:32:01Z"
        },
        {
          "tag": "v0.17.2",
          "kind": "patch",
          "published_at": "2022-05-05T15:32:08Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2022-03-21T13:10:44Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2022-01-31T18:40:38Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2022-01-05T15:30:00Z"
        },
        {
          "tag": "v0.15.3",
          "kind": "patch",
          "published_at": "2021-12-17T16:53:43Z"
        },
        {
          "tag": "v0.15.2",
          "kind": "patch",
          "published_at": "2021-11-03T20:54:47Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2021-10-22T14:07:16Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2021-10-08T15:52:41Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "74c28fbb3fae6801e0cf066850b0972ae2424621",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1479)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-07-22T02:52:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa17df498b6002ff70c1ed8fc4fbfe2a0739ab92",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1478)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-07-17T17:01:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dc0dfa34ea8c86c776e71eed509a8986f3261c6a",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1474)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-07-17T15:52:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "82da61f7472d4655540f666cd04740564d953c24",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1472)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-07-13T10:58:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96fe2f45ff15d0a4744a7c6473a85688362b98a0",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1461)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-07-10T16:56:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "51458888d5e15dbe3acb2e5c28a797a569d95a7f",
          "body": "…#1468)\n\n## Summary\n\nAdds the `envoy_dynamic_extensions` setting from Pomerium to the ingress\nCR `envoyDynamicExtensions`\n\n## Related issues\n\n\n[ENG-4229](https://linear.app/pomerium/issue/ENG-4229/configure-envoy-dyn-exts-in-ingress-controller)\n\n\n## Checklist\n\n- [X] reference any related issues\n- [X] updated docs\n- [X] updated unit tests\n- [X] updated UPGRADING.md\n- [X] add appropriate tag (`improvement` / `bug` / etc)\n- [X] ready for review",
          "is_bot": false,
          "headline": "feat(session_recording): configure dyn ext from pomerium ingress CR (…",
          "author_name": "Alexandre Lamarre",
          "author_login": "alexandreLamarre",
          "committed_at": "2026-07-09T19:25:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "92f2d4995c9023059faca40df0ee4686b620e25c",
          "body": "## Summary\n\nWe need a way to determine the embedded version of envoy without running\ningress controller.\n\nDespite the fact the github.com/pomerium/pomerium/internal/version\ncompile-time metadata encodes this information and is used in the debug\nUI, I duplicated it for consistency in ingress-controll\n[…]\n\n\n## Checklist\n\n- [X] reference any related issues\n- [X] updated docs\n- [X] updated unit tests\n- [X] updated UPGRADING.md\n- [X] add appropriate tag (`improvement` / `bug` / etc)\n- [X] ready for review",
          "is_bot": false,
          "headline": "feat: add --version subcommand (#1463)",
          "author_name": "Alexandre Lamarre",
          "author_login": "alexandreLamarre",
          "committed_at": "2026-07-08T20:38:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78ce840a4e04fa01d2c2ccc066086eb13cfdba3d",
          "body": "…rt (#1462)\n\n## Summary\n\nAdds a hidden `--debug-port` flag to the `all-in-one` command that\noverrides the auto-allocated ephemeral port for Pomerium's internal\ndebug/admin listener.\n\nToday the debug/admin listener port is assigned by `AllocatePorts` and\nchanges on every restart, so the debug endpoin\n[…]\n\n<!-- none -->\n\n## Checklist\n\n- [ ] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [x] add appropriate tag (`improvement`)\n- [x] ready for review",
          "is_bot": false,
          "headline": "all-in-one: add hidden --debug-port flag to pin the debug listener po…",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-07-08T20:23:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a8f55948ea3c5823492aefe1f487238a8a366ff8",
          "body": "## Summary\n\nFixes #1465 — `all-in-one` mode panicked immediately at startup since\n#1460:\n\n```\npanic: conflicting Schema URL: https://opentelemetry.io/schemas/1.41.0 and https://opentelemetry.io/schemas/1.40.0\n```\n\n**Root cause:** the go-group bump pulled otel-sdk **v1.44.0**, which\nmoved `resource.D\n[…]\nen` hit\n`signal: killed` on the envoy-validation subprocess under parallel\nresource pressure; passes in isolation and is not touched by this\nchange.)\n- `go build -tags embed_pomerium ./...` — clean. ✅",
          "is_bot": false,
          "headline": "fix: resolve all-in-one otel Schema URL startup panic (#1466)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-07-08T20:12:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "da2f78ff5643762933d9c5dac30ddf444a4e49a0",
          "body": "## Summary\n- Standardize the Pomerium CRD `UseProxyProtocol` docs text to `PROXY\nprotocol`.\n- Regenerate CRD, deployment, and reference output from the API comment\nsource.\n\n## Validation\n- `make generate`\n- `make build`\n- `./bin/golangci-lint run --timeout=10m ./...`\n- `make test` ran; most packages\n[…]\n/pomerium ./pomerium/envoy` passed.\n\n## AI Assistance\nAI drafted the capitalization cleanup, regenerated outputs, and ran\nvalidation. I reviewed the diffs and accepted only the generated text\nchanges.",
          "is_bot": false,
          "headline": "docs: standardize PROXY protocol capitalization (#1464)",
          "author_name": "bobby",
          "author_login": "desimone",
          "committed_at": "2026-07-08T17:21:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "db4a7166575ccb8958f33cd2abbb4e2d5e81cf00",
          "body": "Add a new CLI option to specify the namespace to use when syncing via\nthe unified API. For Pomerium Zero, this will allow us to sync to a\nspecific cluster within an organization, rather than the default\ncluster. For Pomerium Enterprise, this will let us sync to a namespace\nor cluster other than the global namespace.",
          "is_bot": false,
          "headline": "sync: add --sync-api-namespace-id option (#1454)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-07-06T16:46:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "37d44a34aed474a76ca3b296431ce03d2cfa1d15",
          "body": "…459)\n\nBumps the k8s group with 3 updates in the / directory:\n[k8s.io/api](https://github.com/kubernetes/api),\n[k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver)\nand\n[sigs.k8s.io/gateway-api](https://github.com/kubernetes-sigs/gateway-api).\n\nUpdates `k8s.io/api` \n[…]\n/v1.5.1...v1.6.0\">compare\nview</a></li>\n</ul>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the k8s group across 1 directory with 6 updates (#1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-01T21:07:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7518290cab476259c04e5a0aaeb2d7b61dd0bd7b",
          "body": "Bumps the go group with 2 updates in the / directory:\n[github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager)\nand\n[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa).\n\nUpdates `github.com/cert-manager/cert-manager` from 1.20.2 to 1.20.3\n<details>\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the go group across 1 directory with 2 updates (#1460)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-01T20:27:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "67056f6d8ea4096cc49c04cda354fdede6c1d4d6",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1453)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-07-01T20:10:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6316aa4a07214e50118fb41508c45c08dc299b62",
          "body": "Bumps the github-actions group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` |\n`7.0.0` |\n| [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` |\n`6.5.0` |\n|\n[docker/build-push-action](https://github.com/\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the github-actions group with 5 updates (#1458)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-01T19:35:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e5d1faa982bcf8f16b7d2583aeb664e436d8080",
          "body": "…` in the docker group (#1456)\n\nBumps the docker group with 1 update: distroless/base-debian12.\n\nUpdates `distroless/base-debian12` from `63c73a9` to `ddd86b7`\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=distroless/base-debi\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump distroless/base-debian12 from `63c73a9` to `ddd86b7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-01T19:35:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "379b970b1f66e2b0bbdc3efd0dab05a2f7a01eee",
          "body": "Routes in Pomerium Enterprise do not appear to have a name uniqueness\nconstraint, so the logic to detect an existing route by checking for a\nname collision doesn't work. Check for the failed_precondition error\ncode in addition to the already_exists error code.",
          "is_bot": false,
          "headline": "sync: handle route failed_precondition error (#1452)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-06-30T23:07:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2af4b03f033ff55e4315871b62a4471eaaeb6b2e",
          "body": "When syncing to Pomerium Enterprise, there is a chicken-and-egg problem:\nEnterprise relies on Pomerium Core to authenticate all incoming API\nrequests. But the Pomerium route to Enterprise is itself defined using\nan Ingress, so we can't communicate with the API at all before this\nroute exists. We can\n[…]\nf the Ingress host domain does not resolve from inside the pod\nnetwork, the API sync should still work.\n\nTo avoid the overhead of an extra controller, the Ingress data is\nfetched just once at startup.",
          "is_bot": false,
          "headline": "sync: add bootstrap ingress support (#1449)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-06-29T18:12:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c5cf998d132ec7dff34a1df5de80bae36f0a5a3",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1451)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-06-24T16:01:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c0a5aa26cdd2a39eb72a39f57b4f355f933b141",
          "body": "Add CRD-less kustomize variants and a workflow that publishes the CRDs\nto the install repo.\n\nPart of [OPE-314](https://linear.app/pomerium/issue/OPE-314).",
          "is_bot": false,
          "headline": "Add CRD-less kustomize variants + CRD sync to install (#1444)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-06-22T17:43:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "13b8ac95740ed87a054bfa7bc8998464991869c1",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1450)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-06-22T15:09:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca2724ee5783061c80620699cd586f34c31522aa",
          "body": "The allow_public_unauthenticated_access and allow_any_authenticated_user\nannotations are not honored by the current unified API sync logic. These\nare part of the \"Base\" annotations rather than the \"Policy\" annotations,\nbut they should still affect the derived policy. Make sure the\nconversion logic accounts for these annotations.",
          "is_bot": false,
          "headline": "sync: add missing policy annotations (#1446)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-06-18T17:47:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0d5a91c754b008ecb34e89880021de1187bbe035",
          "body": "In the all-in-one mode, certain bootstrap settings are passed to\nPomerium Core using an in-memory ConfigSource. Currently the\nAPIReconciler is unaware of these bootstrap settings, and when it syncs\na settings entity via the API it will fill in the Core defaults.\n\nThis is a problem for the 'address' \n[…]\nettings available to the API sync logic. The sync logic will\napply all of the Pomerium CRD settings on top of these base settings.\n\nThe standalone mode can continue to use the Core defaults as before.",
          "is_bot": false,
          "headline": "sync: do not clobber bootstrap settings (#1447)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-06-18T16:46:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2dbbb49d52d202394a95c59f95283b759f1bc2a8",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1448)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-06-18T13:23:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "56e7ee283c909433e4c746326b39d7fd40d515d7",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1445)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-06-17T15:44:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52ef1ce7cad2c51a07dd38ff811c27984af14b94",
          "body": "Pomerium Enterprise expects the filter key \"originator_id\" rather than\n\"originatorId\", while Pomerium Zero accepts either, so switch to snake \ncase.",
          "is_bot": false,
          "headline": "sync: query filter should use snake_case (#1442)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-06-15T17:56:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b39d9a4dfc77270173b4b85c04b541a7cb3994e",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1439)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-06-15T14:50:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81bd70d086754e6bfd302ce4883f124cff82b200",
          "body": "`--debug-pomerium` set `LogLevel=debug` but left `ProxyLogLevel` empty,\nso envoy inherited debug (`firstNonEmpty(ProxyLogLevel, LogLevel,\ndebug)` in pkg/envoy/envoy.go), flooding logs with envoy output. Pin\n`ProxyLogLevel=info` so `--debug-pomerium` raises only Pomerium core\nlogging; `--debug-envoy` still opts envoy into debug explicitly.\n\nBehavior change: `--debug-pomerium` alone no longer produces envoy debug\nlogs.\n\n---------\n\nSigned-off-by: Denis Mishin <dmishin@pomerium.com>",
          "is_bot": false,
          "headline": "cmd: --debug-pomerium raises only core log level, not envoy (#1441)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-06-09T20:07:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "35964eaa7a572645bf374b4263f65233ee628103",
          "body": "Bumps pomerium/pomerium to pick up pomerium/pomerium#6442 (surface the\nunderlying error when an MCP access token can't be resolved).\n\nSigned-off-by: Denis Mishin <dmishin@pomerium.com>",
          "is_bot": false,
          "headline": "bump pomerium/pomerium (#1440)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-06-09T18:52:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "90113f9f8262adc554ec23ed74f4fa7a9dafa8e3",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1434)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-06-03T23:52:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b4916cd4f97523bc78829d702e97bff70e9cf22",
          "body": "## Summary\nUses the latest pomerium sdk, which no longer duplicates protobuf\ndefinitions.\n\n## Related issues\n-\n[ENG-4071](https://linear.app/pomerium/issue/ENG-4071/core-setup-workspace-and-gomod-files-for-config-and-databroker)\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: update sdk (#1432)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-06-03T23:35:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f8498610d61cf92eeb8cb23c0bed84d08e680cf",
          "body": "…` in the docker group (#1435)\n\nBumps the docker group with 1 update: distroless/base-debian12.\n\nUpdates `distroless/base-debian12` from `e196d04` to `63c73a9`\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=distroless/base-debi\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump distroless/base-debian12 from `e196d04` to `63c73a9…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-03T15:13:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "386f13ad7f405f0504037e2003101b6016dbc51c",
          "body": "Bumps the k8s group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [k8s.io/api](https://github.com/kubernetes/api) | `0.36.0` | `0.36.1`\n|\n|\n[k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver)\n| `0.36.0` | `0.36.1` |\n| [k8s.io/apimachinery](https:/\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the k8s group with 6 updates (#1437)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-03T15:13:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "381f100dffda7cdcb74c4c97e213aa00e6a0f56b",
          "body": "Bumps the github-actions group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` |\n`6.0.3` |\n| [docker/metadata-action](https://github.com/docker/metadata-action) |\n`6.0.0` | `6.1.0` |\n|\n[docker/setup-buildx-action](https\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the github-actions group with 6 updates (#1438)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-03T15:12:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0ba9f48de0ac80c5a82c5dc5c19ac0646c393a40",
          "body": "Bumps the go group with 3 updates:\n[github.com/go-playground/validator/v10](https://github.com/go-playground/validator),\n[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)\nand\n[go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go).\n\nUpdates `gi\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the go group with 3 updates (#1436)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-03T14:03:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c2fffa2935e29e810827f198da70b9d062e32a68",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1433)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-29T16:54:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "981fac225a991dd9f7012c7ccf68ae98e23a3c17",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1431)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-28T15:58:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea7161b35e77d196199ecb19475b82d9f0ba673d",
          "body": "## Summary\n\nInitialize the config using `config.New`, which contains setup logic for\nsome fields that do not have a valid zero value.\n\nSee also: https://github.com/pomerium/pomerium/pull/6353.\n\n## Related issues\n\n<!-- For example...\nFixes #159\n-->\n\n\n## Checklist\n\n- [ ] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [ ] ready for review",
          "is_bot": false,
          "headline": "Update config initialization to use config.New (#1430)",
          "author_name": "Joe Kralicky",
          "author_login": "kralicky",
          "committed_at": "2026-05-27T20:59:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "570f349d5292826afc83b486d212889662ef08cd",
          "body": "## Summary\n\nUpdate pomerium/pomerium to latest main\n\n## Related issues\n\n<!-- For example...\nFixes #159\n-->\n\n\n## Checklist\n\n- [ ] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [ ] ready for review",
          "is_bot": false,
          "headline": "update core (#1429)",
          "author_name": "Joe Kralicky",
          "author_login": "kralicky",
          "committed_at": "2026-05-27T20:14:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3f0dc705474f9d8423a9108dd25a7a849d5c85c2",
          "body": "config \n```yaml\napiVersion: ingress.pomerium.io/v1\nkind: Pomerium\nmetadata:\n  name: global-mcp\nspec:\n  secrets: pomerium-mcp/bootstrap\n  # persistent data broker is required for MCP\n  storage:\n    file:\n      path: /data/pomerium.db\n  runtimeFlags:\n    mcp: true\n  # specifies the allowed domains for\n[…]\n\n  mcpAllowedAsMetadataDomains: []\n  # specifies the allowed domains for MCP client ID metadata URLs. This is required when MCP is enabled.\n  mcpAllowedClientIdDomains: [\"vscode.dev\", \"claude.ai\"]\n```",
          "is_bot": false,
          "headline": "Allowing to have 2 pomerium ICs in a same cluster (#1388)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-05-27T19:54:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1215d1fb0dfc09fc411d401b397d86a6f7c837a2",
          "body": "This PR updates dependencies not managed by dependabot.\n\n---------\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>\nCo-authored-by: Kenneth Jenkins <51246568+kenjenkins@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1428)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-27T19:34:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9e9620f65f2112541805c0ba1908bf4a90ed0583",
          "body": "We currently have two copies of the core config protos in the dependency\ntree: one from pomerium/pomerium, and one from pomerium/sdk-go (for the\nunified API / connect-rpc support). If these two get out of sync,\nsettings may not serialize correctly. For now, let's mitigate this issue\nby syncing both of these modules in the update-dependencies script.",
          "is_bot": false,
          "headline": "update sdk-go along with pomerium core (#1427)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-05-27T18:18:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78441396a9118b3b56ba8dd594b0e28faa91ec72",
          "body": "This PR updates dependencies not managed by dependabot.\n\n---------\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>\nCo-authored-by: Caleb Doxsey <caleb@doxsey.net>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1426)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-27T17:25:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b305486c95e2227ad52644d87020c703e2de0de9",
          "body": "…ll required CRDs exist (#1424)\n\n## Summary\nDelay starting the certificate controller until all the required CRDs\nexist.\n\nCurrently if the cert-manager CRDs don't exist, an error will be logged\nevery 10 seconds:\n\n```json\n{\n  \"level\":\"error\",\n  \"ts\":\"2026-05-26T15:08:46Z\",\n  \"logger\":\"controller-runt\n[…]\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: delay starting the certificate controller until a…",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-27T16:51:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ebc2b257dfa79359457f7d2374c62a2a8ab27b5",
          "body": "Add two CEL constraints on the Pomerium CRD to enforce that if the\nidentityProvider field is set, the authenticate field must be set as\nwell (and vice versa).\n\nLogically, this could be expressed as the single constraint\nhas(self.identityProvider) == has(self.authenticate), but if we split it\ninto two we can customize the error message depending on the case.",
          "is_bot": false,
          "headline": "crd: identityProvider <-> authenticate constraints (#1423)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-05-27T16:43:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2d497eb6e03ac6e8ac3ef6afc4c68ef3a2558b1b",
          "body": "…ng (#1418)\n\n## Summary\nAdd some more documentation around the certificate auto provisioning\noptions.\n\n## Related issues\n-\n[ENG-4055](https://linear.app/pomerium/issue/ENG-4055/documentation-document-new-certificate-controller)\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: add more docs for the certificate auto provisioni…",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-27T12:27:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "752351fd9aeb9ff0d43151280ba51551cf3d4748",
          "body": "## Summary\n\nBump pomerium/pomerium to latest main\n\n## Related issues\n\n<!-- For example...\nFixes #159\n-->\n\n\n## Checklist\n\n- [ ] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [ ] ready for review",
          "is_bot": false,
          "headline": "update core (#1425)",
          "author_name": "Joe Kralicky",
          "author_login": "kralicky",
          "committed_at": "2026-05-26T22:02:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b95abdbceff2e8bdc59cacc8cdc680d561b83297",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1421)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-26T12:50:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9da4fddf6620e76c7a7f00ef6662e955b17673ab",
          "body": "## Summary\nProduction-hardening defaults for the `config/clustered-databroker`\noverlay:\n\n- `fsGroup: 65532` and `fsGroupChangePolicy: OnRootMismatch` so the\nnon-root pomerium container can write to the databroker PVC on first\nprovisioning.\n- Pod anti-affinity by `kubernetes.io/hostname` so RAFT memb\n[…]\nith `minAvailable: 2` to preserve RAFT quorum\nthrough voluntary disruptions.\n- CPU request `500m` (up from 300m), needed for anti-affinity to\nschedule on environments that gate scheduling on requests.",
          "is_bot": false,
          "headline": "clustered-databroker: production-hardening defaults (#1422)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-05-25T19:09:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c7527f33ea7151a1e951b5764f29d8d77eb8db72",
          "body": null,
          "is_bot": false,
          "headline": "ingress-controller/ci: add integration test (#1409)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-22T22:30:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f64fabb9939711737a53847dc46d72f2426581cf",
          "body": "## Summary\n`make build` failed on clean checkout with `sh: ts-node: command not\nfound` when `internal/ui/node_modules` was missing, because the UI build\ntarget was keyed off `internal/ui/package.json` (whose recipe is\nactually `npm ci`). Once `package.json` existed, make considered the\ntarget up-to-date and skipped `npm ci`, even though `node_modules` did\nnot exist.",
          "is_bot": false,
          "headline": "Makefile: rerun npm ci when node_modules is missing (#1417)",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-05-22T21:46:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd69044d2e4b8718e6a8a57cb9e26d176f8d264c",
          "body": "This PR updates dependencies not managed by dependabot.\n\n---------\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>\nCo-authored-by: Caleb Doxsey <caleb@doxsey.net>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1419)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-22T18:34:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b7053280e6d7bc4970ff4a9e6a063f44da12ad4",
          "body": null,
          "is_bot": false,
          "headline": "bump pomerium/pomerium (#1420)",
          "author_name": "Joe Kralicky",
          "author_login": "kralicky",
          "committed_at": "2026-05-22T18:06:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e89c4829d4e165a1bbaa2ed1b8aeab3f7ead7f41",
          "body": "Pomerium Core now has support for using the hosted authenticate service\nas an OIDC provider. In order to configure this for ingress-controller\nwe need to:\n- add 'hosted' to the allowed enum values for the identity provider\n- relax some of the validation logic that requires a client_id /\nclient_secret\n\nAlso add 'apple' and 'cognito' to the identity provider enum values\nwhile we're here (these are supported in Core and must have been missed\nin the schema).",
          "is_bot": false,
          "headline": "support hosted authenticate OIDC mode (#1414)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-05-19T21:05:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "06a1392941b4a39e8ff943118ed140def9c3ebd6",
          "body": "… annotation (#1416)\n\n## Summary\n- Add\n`ingress.pomerium.io/enable_google_cloud_serverless_authentication` to\nthe recognized Ingress annotation allowlist. Maps to the\n`EnableGoogleCloudServerlessAuthentication` field on the Pomerium Route\nproto, which adds `Authorization: Bearer ID_TOKEN` headers for GCP\nserverless upstreams (Cloud Run, Cloud Functions).",
          "is_bot": false,
          "headline": "ingress-controller: add enable_google_cloud_serverless_authentication…",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-05-19T18:24:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b988bc9ddf3e253fececd1a7ade0f94b9b6bcf6b",
          "body": "## Summary\nUse `asdf` to manage the local `kustomize`.\n\n## Related issues\n\n\n## Checklist\n\n- [ ] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [x] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller/ci: use asdf for kustomize (#1415)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-18T16:26:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d78135cbd66f21cad668543247ca62fee020b4ba",
          "body": "## Summary\nAdd a new controller which will create `Certificate` resources for\nroutes in the databroker which lack certificates. The corresponding\nsecrets that get generated are then stored in the databroker.\n\n## Related issues\n-\n[ENG-3993](https://linear.app/pomerium/issue/ENG-3993/ingress-controlle\n[…]\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [x] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: add certificate controller (#1407)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-18T14:57:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d5167d6140a7b2c5b2263904e92a7ff5a5573bd3",
          "body": "Add a new Ingress annotation 'ingress.pomerium.io/ssh_upstream' for\nnative SSH routes, following the example of the similar 'tcp_upstream'\nand 'udp_upstream' annotations.",
          "is_bot": false,
          "headline": "add ingress annotation for native ssh (#1413)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-05-15T21:25:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dfec47548c8829a10e7c1772f532cb03cee0046b",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1411)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-15T04:38:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "68903df803b081867b27a417ec96428ee8c7a325",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1408)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-13T02:48:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a3ee853f7fdfd681d3c2665df63d3636ce620de",
          "body": "…#1405)\n\n## Summary\nAs part of provisioning missing certificates we will need to extract the\ncertificate names from any existing certificates and match them with\nroute names.\n\n## Related issues\n-\n[ENG-4006](https://linear.app/pomerium/issue/ENG-4006/ingress-controller-add-function-to-convert-databro\n[…]\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [x] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: extract certificate and route names from config (…",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-11T19:42:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c58c66185870539c002e8a99d0eea665356e5a0f",
          "body": "…gke (#1401)\n\n## Summary\nRemove the `quic` port from the base config and add two new configs for\nEKS and GKE that should configure services in such a way that they can\nbe used with HTTP/3.\n\n## Related issues\n-\n[ENG-3962](https://linear.app/pomerium/issue/ENG-3962/pomerium-ingress-controller-loadbala\n[…]\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller/config: remove quic port, add configs for eks and …",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-11T16:07:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a7ed6d349d9fa91920e08b7ebc7aec64579e98f7",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1399)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-08T21:11:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "efd8abc921d1053c95c4ce318626944dc950ffd3",
          "body": "## Summary\nAdd a certificate matcher which will keep track of any missing host\nnames for a set of certificates and routes.\n\nIn terms of how this will end up being used, we will query for all\nroutes / key pairs, add them to this matcher, and then based on the\nmissing names provision certificates via \n[…]\n\n\n## Checklist\n\n- [ ] reference any related issues\n- [ ] updated docs\n- [x] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: add certificate matcher (#1404)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-07T19:20:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a267d11beb18c43fc9fcecfc4acd0808e07da9de",
          "body": "Bumps the go group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [connectrpc.com/connect](https://github.com/connectrpc/connect-go) |\n`1.19.1` | `1.19.2` |\n|\n[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)\n| `1.15.1` | `1.16.1` |\n| [gi\n[…]\n1.80.0...v1.81.0\">compare\nview</a></li>\n</ul>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the go group across 1 directory with 6 updates (#1398)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-06T19:39:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c161d8e8fe7dba0d9965269bbecaecd4d61677d1",
          "body": "…` in the docker group (#1394)\n\nBumps the docker group with 1 update: distroless/base-debian12.\n\nUpdates `distroless/base-debian12` from `8ad5380` to `e196d04`\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=distroless/base-debi\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump distroless/base-debian12 from `8ad5380` to `e196d04…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-06T19:38:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a34d8fd95c8852a0ae9af26eaa1990b296730260",
          "body": "Bumps the github-actions group with 4 updates:\n[docker/login-action](https://github.com/docker/login-action),\n[docker/build-push-action](https://github.com/docker/build-push-action),\n[actions/setup-node](https://github.com/actions/setup-node) and\n[peter-evans/create-pull-request](https://github.com/\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the github-actions group with 4 updates (#1397)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-06T19:37:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e3adea357d6fe7f98c0e10b09cb2a2d68acdd3ba",
          "body": "## Summary\nAdd a new certificate name index which will be used for matching\ncertificates to routes.\n\nAlthough we have a similar index in core, it does not support dynamic\nupdates and would need to be rebuilt every time, but this index would be\nupdated by individual updates via `Sync` calls from the \n[…]\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [x] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: add new certificate name index (#1403)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-06T19:28:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "82a588a7f8d0771ffc92c0655baca558350c060a",
          "body": "…402)\n\n## Summary\nAdd a new configuration option for certificate auto provisioning.\n\n## Related issues\n-\n[ENG-3992](https://linear.app/pomerium/issue/ENG-3992/ingress-controller-add-new-configuration-option-for-automatic)\n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller/config: add certificate auto provision setting (#1…",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-05-06T19:15:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "691242efc3b476bb8a8a0bdbea2124bb85a5a344",
          "body": "When syncing settings via the new API we should apply any default\nvalues explicitly, as they may not be inferred by the API\nimplementation.\n\nAlso remove the hard-coded default authenticate service URL, as this\nshould no longer be necessary.",
          "is_bot": false,
          "headline": "rework settings sync to apply Core defaults (#1391)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-05-04T21:08:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb0d004a3da0873de4f86c091bb9720d0f360715",
          "body": "Bumps the k8s group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n|\n[k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver)\n| `0.35.3` | `0.36.0` |\n| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) |\n`0.35.3` | `0.36.0` |\n| [k8s.io/api\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the k8s group with 6 updates (#1396)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-04T18:31:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fec446c8046397d8f3aba1df2a170fc2c0883ed3",
          "body": "This PR updates dependencies not managed by dependabot.\n\n---------\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>\nCo-authored-by: Caleb Doxsey <caleb@doxsey.net>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1393)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-05-04T14:17:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "edc78a275e71837e3211657eef991be20b9411b4",
          "body": "Fix the workflow for syncing the generated reference.md file to the\ndocumentation repo by adding a step to install a newer nodejs version.\nAlso update the script so that if the 'yarn' step fails, the script will\nnot continue. (Combining 'yarn && yarn prettier ...' in one command\nmeant that even with 'set -e', an error from 'yarn' would not stop the\nscript.)",
          "is_bot": false,
          "headline": "ci: fix docs pull request workflow (#1392)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-04-30T22:38:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "05ce0e8a4581a46da432b3ee67a97d2794e45c2c",
          "body": "In principle, when ingress-controller runs in the standalone mode and \nuses the new unified API sync, it does not need a direct connection to\nthe Core databroker. However, ingress-controller does currently rely on\nCore for leader election.\n\nAdd support to instead use Kubernetes leader election in th\n[…]\ne lease being acquired is not\nnecessarily a databroker lease. Refactor the kustomize configuration so\nthat we can add permissions for acquiring a k8s lease object only within\nthe 'pomerium' namespace.",
          "is_bot": false,
          "headline": "add support for k8s leader election (#1386)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-04-30T17:55:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "87262118521653c0f47dd85f2d7d5b709cc6d93f",
          "body": "… (#1390)\n\n## Summary\n\nBumps `github.com/pomerium/pomerium` to `b6db439128bf`, which brings in\n[pomerium/pomerium#6309](https://github.com/pomerium/pomerium/pull/6309)\n(mcp: strip default ports when comparing PRM resource to upstream URL).\n\nWithout this, every MCP route through the ingress controlle\n[…]\nerium#6309\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [x] updated unit tests (in core)\n- [ ] updated UPGRADING.md\n- [x] add appropriate tag (\\`bug\\`)\n- [ ] ready for review",
          "is_bot": false,
          "headline": "deps: upgrade pomerium core to pick up MCP PRM port-normalization fix…",
          "author_name": "Denis Mishin",
          "author_login": "wasaga",
          "committed_at": "2026-04-30T15:40:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "89c6a676399001f5ea60c5289d13289a94d9f81f",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1385)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-30T12:31:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3fddd34f6b6b8ce0bc7aed3bf5a0825a072c975e",
          "body": "Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.1 to 5.9.2.\n- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)\n- [Commits](jackc/pgx@v5.9.1...v5.9.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/jackc/pgx/v5\n  dependency-version: 5.9.2\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#1387)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-24T22:28:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d95edbed7233bead34a529ed3fb66be2c133abe0",
          "body": "During API sync, if we successfully create a Pomerium entity, but fail\nto store the assigned ID in the custom k8s annotation, subsequent\nmodifications would fail to sync when we try to create an entity that\nalready exists.\n\nAdd error handling for this case: if we get an already_exists error code\nwhen attempting to create a Pomerium entity, attempt to look up the\nentity by the entity name.\n\nMake sure we surface any errors returned by a Patch() call to the\nreconciler loop.",
          "is_bot": false,
          "headline": "api sync: recover from a failed metadata update (#1384)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-04-23T22:12:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "82e2cff8c0fb05422d2b1ef38a4a8c971e3bea4d",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1383)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-20T21:42:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "931fde8b8efcc8e4aafd12295348f7e5f11429e2",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1381)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-17T20:34:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97e8465e1edd401d33b060880998f4655b71fe87",
          "body": "Rename the \"acquire databroker lease\" ready check to\n\"acquire-databroker-lease\" as this name is used as a URL path component.\n\nRegister a (no-op) /startupz handler to satisfy the startup probe from\nthe default kustomize configuration.",
          "is_bot": false,
          "headline": "fix standalone mode health checks (#1380)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-04-17T16:02:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b713a8c5a1f04642e09d0af4cb5b040d4b599db5",
          "body": "## Summary\nFix the protobuf conflict error because of two `config.proto` files.\n\n## Related issues\n- #1378 \n\n\n## Checklist\n\n- [x] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller: fix protobuf conflict (#1382)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-04-17T16:02:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b4839b7a7e854da91f5280a29afc5c5296d17c5",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1379)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-16T17:00:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aaef546417270903d2a1db8c8c4c674023205de1",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1377)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-16T14:59:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45d2b9c706dd293723a35b109f6309fdc2204870",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1376)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-15T16:05:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a01b76023b100dd81cb7cb31be2b80646a6e0cf",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1375)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-14T21:16:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9d16c9f8c2431786107d569575394a9ef4f5d36",
          "body": "Add a new APIReconciler type that implements the same interfaces as the\nexisting DataBrokerReconciler, but using the unified API rather than the\ncurrent databroker records. \n\nGive the APIReconciler access to the Kubernetes API client, so that it \ncan read and modify resource metadata. When we create\n[…]\nss-controller the additional permissions it needs to\nmodify resource metadata on Ingress, Secret, HTTPRoute, and PolicyFilter\nresources.\n\n---------\n\nCo-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>",
          "is_bot": false,
          "headline": "add support for syncing via unified API (#1342)",
          "author_name": "Kenneth Jenkins",
          "author_login": "kenjenkins",
          "committed_at": "2026-04-13T20:52:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2ee2e5a2436578e85718ae89226cd9551a945522",
          "body": "## Summary\nAdd the route and global settings `allow_upgrades` option.\n\n## Related issues\n-\n[ENG-3864](https://linear.app/pomerium/issue/ENG-3864/ingress-controllerconfig-add-allow-upgrades)\n\n\n## Checklist\n\n- [x] reference any related issues\n- [x] updated docs\n- [x] updated unit tests\n- [ ] updated UPGRADING.md\n- [x] add appropriate tag (`improvement` / `bug` / etc)\n- [x] ready for review",
          "is_bot": false,
          "headline": "ingress-controller/config: add support for allow_upgrades (#1374)",
          "author_name": "Caleb Doxsey",
          "author_login": "calebdoxsey",
          "committed_at": "2026-04-13T19:09:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae8c082b659a6a1d8342fc83f1830f3592baf8f5",
          "body": "## Summary\n\n`deployment.yaml` references incorrect `containerPort` for `quic`. - It\npoints at `443` while envoy has a UDP listener only on `8443` (the same\nport number as for TCP listener).\nAs a result, end clients cannot connect to the QUIC-listeners.\n\nThe PR fixes the issue by referencing correct \n[…]\n\n\n## Checklist\n\n- [X] reference any related issues\n- [ ] updated docs\n- [ ] updated unit tests\n- [ ] updated UPGRADING.md\n- [ ] add appropriate tag (`improvement` / `bug` / etc)\n- [X] ready for review",
          "is_bot": false,
          "headline": "fix(deployment): incorrect containerPort for QUIC (#1372)",
          "author_name": "Igor Beliakov",
          "author_login": "weisdd",
          "committed_at": "2026-04-13T19:04:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2b9ae0541d4c745aba04f11e3b322c09fcfdecbd",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1373)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-13T14:54:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f40ddc6af394dd656394be80a297b31008208705",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1370)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-10T14:04:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ed7deec49c807642b0cb2e4921a5435c19515a84",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1369)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-09T13:27:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1af8cdfe1c9f24f8c810b296b37fe3c6acb4599",
          "body": "…tlptracehttp from 1.42.0 to 1.43.0 (#1366)\n\nBumps\n[go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go)\nfrom 1.42.0 to 1.43.0.\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/open-telemetry/opente\n[…]\n1.42.0...v1.43.0\">compare\nview</a></li>\n</ul>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/o…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-09T02:23:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "064104d9bf70daea5d148024fece857c46066d05",
          "body": "…(#1367)\n\nBumps\n[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go)\nfrom 1.42.0 to 1.43.0.\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md\">go.opentelemetry.io/otel/sdk's\nchan\n[…]\nub.com/pomerium/ingress-controller/network/alerts).\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-09T01:59:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba9b9f40473009b106d6934db78694a066a722dc",
          "body": "This PR updates dependencies not managed by dependabot.\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1365)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-08T04:23:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9332651ec054cc9dcbe2447102dc56172aadab17",
          "body": "This PR updates dependencies not managed by dependabot.\n\n---------\n\nCo-authored-by: GitHub Actions <apparitor@users.noreply.github.com>\nCo-authored-by: Caleb Doxsey <caleb@doxsey.net>",
          "is_bot": false,
          "headline": "ci: update dependencies (#1358)",
          "author_name": "apparitor",
          "author_login": "apparitor",
          "committed_at": "2026-04-07T18:56:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4cdeea320623b8ffd2987096d3f6d9f7a8828de4",
          "body": "Bumps the go group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n|\n[github.com/go-playground/validator/v10](https://github.com/go-playground/validator)\n| `10.30.1` | `10.30.2` |\n|\n[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)\n| `1.14.0\n[…]\n1.79.3...v1.80.0\">compare\nview</a></li>\n</ul>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the go group across 1 directory with 5 updates (#1359)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-03T16:24:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d27cfaa3521e699ce293a69bc0d7407159c0adc0",
          "body": "…#1364)\n\nBumps\n[github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from\n4.1.3 to 4.1.4.\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a\nhref=\"https://github.com/go-jose/go-jose/commit/0e59876635f3dbf46d7b5e97b52bb75a3f96e7d9\"><code>0e59876</code></a>\nMerge commit from fork</li>\n<li>\n[…]\n/v4.1.3...v4.1.4\">compare\nview</a></li>\n</ul>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-03T16:23:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f0045389d501bfc96049889d5481d242f0ffe30e",
          "body": "…#1363)\n\nBumps\n[github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from\n3.0.4 to 3.0.5.\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a\nhref=\"https://github.com/go-jose/go-jose/commit/be2f6548701d4ba561cd61c7d4a2f1289b66c273\"><code>be2f654</code></a>\nci: update Go versions for GHA w\n[…]\nub.com/pomerium/ingress-controller/network/alerts).\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-03T15:33:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a3aed3e1d64fd488ac90ea2f10aa56f4c19d103c",
          "body": "Bumps the k8s group with 7 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [k8s.io/api](https://github.com/kubernetes/api) | `0.35.2` | `0.35.3`\n|\n|\n[k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver)\n| `0.35.2` | `0.35.3` |\n| [k8s.io/apimachinery](https:/\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the k8s group with 7 updates (#1361)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-02T21:45:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 64,
      "commits_last_year": 220,
      "latest_release_at": "2026-07-16T19:35:18Z",
      "latest_release_tag": "v0.33.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 48,
      "days_since_latest_release": 7,
      "mean_days_between_releases": 16.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/pomerium/ingress-controller",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/pomerium/ingress-controller",
          "is_deprecated": false,
          "latest_version": "v0.33.0",
          "repository_url": "https://github.com/pomerium/ingress-controller",
          "versions_count": 64,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-16T19:17:20Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 22,
      "stars": 35,
      "watchers": 5,
      "fork_history": {
        "days": [
          {
            "date": "2022-04-23",
            "count": 1
          },
          {
            "date": "2022-10-22",
            "count": 1
          },
          {
            "date": "2023-07-05",
            "count": 1
          },
          {
            "date": "2023-07-19",
            "count": 1
          },
          {
            "date": "2023-09-20",
            "count": 1
          },
          {
            "date": "2023-10-27",
            "count": 1
          },
          {
            "date": "2023-11-02",
            "count": 1
          },
          {
            "date": "2024-02-28",
            "count": 1
          },
          {
            "date": "2024-03-26",
            "count": 1
          },
          {
            "date": "2024-08-30",
            "count": 1
          },
          {
            "date": "2025-02-04",
            "count": 1
          },
          {
            "date": "2025-02-10",
            "count": 1
          },
          {
            "date": "2025-03-28",
            "count": 1
          },
          {
            "date": "2025-04-01",
            "count": 1
          },
          {
            "date": "2025-05-13",
            "count": 1
          },
          {
            "date": "2025-07-06",
            "count": 1
          },
          {
            "date": "2026-03-22",
            "count": 1
          },
          {
            "date": "2026-04-10",
            "count": 1
          },
          {
            "date": "2026-04-24",
            "count": 1
          },
          {
            "date": "2026-07-09",
            "count": 1
          },
          {
            "date": "2026-07-17",
            "count": 1
          },
          {
            "date": "2026-07-22",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 22,
        "total_forks": 22
      },
      "star_history": null,
      "open_issues_and_prs": 46
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 67498,
      "source_files_sampled": 143,
      "oversized_source_files": 1,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "oras.land/oras-go/v2",
            "direct": false,
            "version": "v2.6.1",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.1,
            "advisory_ids": [
              "GHSA-fxhp-mv3v-67qp"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 22
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 16
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 1,
          "unknown": 1
        },
        "advisory_count": 2,
        "affected_count": 2,
        "assessed_count": 338,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "connectrpc.com/connect",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.20.0"
        },
        {
          "name": "github.com/cenkalti/backoff/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.3.0"
        },
        {
          "name": "github.com/cert-manager/cert-manager",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.20.3"
        },
        {
          "name": "github.com/envoyproxy/go-control-plane/envoy",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.37.0"
        },
        {
          "name": "github.com/go-logr/logr",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.3"
        },
        {
          "name": "github.com/go-logr/zapr",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "github.com/go-playground/validator/v10",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v10.30.3"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gosimple/slug",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/go-set/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "github.com/iancoleman/strcase",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/martinlindhe/base36",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/open-policy-agent/opa",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.18.1"
        },
        {
          "name": "github.com/pomerium/pomerium",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.32.5-rc.1.0.20260722011640-c0fe8baec82f"
        },
        {
          "name": "github.com/pomerium/pomerium/pkg/grpc/config",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260722011640-c0fe8baec82f"
        },
        {
          "name": "github.com/pomerium/pomerium/pkg/grpc/databroker",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260722011640-c0fe8baec82f"
        },
        {
          "name": "github.com/pomerium/sdk-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.10-0.20260717162757-c07b754ff8f0"
        },
        {
          "name": "github.com/rs/zerolog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.35.1"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.10"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.21.0"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/volatiletech/null/v9",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v9.0.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.uber.org/mock",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "go.uber.org/zap",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.28.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.57.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.22.0"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.12-0.20260120151049-f2248ac996af"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "k8s.io/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.2"
        },
        {
          "name": "k8s.io/apiextensions-apiserver",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.2"
        },
        {
          "name": "k8s.io/apimachinery",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.2"
        },
        {
          "name": "k8s.io/apiserver",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.2"
        },
        {
          "name": "k8s.io/client-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.2"
        },
        {
          "name": "sigs.k8s.io/controller-runtime",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.24.1"
        },
        {
          "name": "sigs.k8s.io/gateway-api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "connectrpc.com/connect",
            "direct": true,
            "version": "v1.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v4",
            "direct": true,
            "version": "v4.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cert-manager/cert-manager",
            "direct": true,
            "version": "v1.20.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": true,
            "version": "v1.37.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": true,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/zapr",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-playground/validator/v10",
            "direct": true,
            "version": "v10.30.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gosimple/slug",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-set/v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/martinlindhe/base36",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/open-policy-agent/opa",
            "direct": true,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/pomerium",
            "direct": true,
            "version": "v0.32.5-rc.1.0.20260722011640-c0fe8baec82f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/pomerium/pkg/grpc/config",
            "direct": true,
            "version": "v0.0.0-20260722011640-c0fe8baec82f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/pomerium/pkg/grpc/databroker",
            "direct": true,
            "version": "v0.0.0-20260722011640-c0fe8baec82f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/sdk-go",
            "direct": true,
            "version": "v0.0.10-0.20260717162757-c07b754ff8f0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/zerolog",
            "direct": true,
            "version": "v1.35.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": true,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/volatiletech/null/v9",
            "direct": true,
            "version": "v9.0.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/mock",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": true,
            "version": "v1.28.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": true,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/api",
            "direct": true,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/apiextensions-apiserver",
            "direct": true,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/apimachinery",
            "direct": true,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/apiserver",
            "direct": true,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/client-go",
            "direct": true,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/controller-runtime",
            "direct": true,
            "version": "v0.24.1",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/gateway-api",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go",
            "direct": false,
            "version": "v1.36.11-20260415201107-50325440f8f2.1",
            "ecosystem": "go"
          },
          {
            "name": "buf.build/go/protovalidate",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "charm.land/bubbles/v2",
            "direct": false,
            "version": "v2.1.0",
            "ecosystem": "go"
          },
          {
            "name": "charm.land/bubbletea/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "charm.land/lipgloss/v2",
            "direct": false,
            "version": "v2.0.4",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.24.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.61.3",
            "ecosystem": "go"
          },
          {
            "name": "connectrpc.com/grpchealth",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "connectrpc.com/grpcreflect",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "connectrpc.com/otelconnect",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "contrib.go.opencensus.io/exporter/prometheus",
            "direct": false,
            "version": "v0.4.2",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/bigmod",
            "direct": false,
            "version": "v0.0.3",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/csrf",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/keygen",
            "direct": false,
            "version": "v0.0.0-20250626140535-790df0a991a0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agnivade/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/antlr4-go/antlr/v4",
            "direct": false,
            "version": "v4.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apapsch/go-jsonmerge/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/armon/go-metrics",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.42.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.27",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.26",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/s3/manager",
            "direct": false,
            "version": "v1.20.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.31",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.25",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.102.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.31.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.36.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.43.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azcore",
            "direct": false,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azidentity",
            "direct": false,
            "version": "v1.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/internal",
            "direct": false,
            "version": "v1.11.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/storage/azblob",
            "direct": false,
            "version": "v1.6.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azuread/microsoft-authentication-library-for-go",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bits-and-blooms/bitset",
            "direct": false,
            "version": "v1.24.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver/v4",
            "direct": false,
            "version": "v4.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/caddyserver/certmagic",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/caddyserver/zerossl",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cafxx/httpcompression",
            "direct": false,
            "version": "v0.0.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ccoveille/go-safecast/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/ultraviolet",
            "direct": false,
            "version": "v0.0.0-20260525132238-948f4557a654",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.11.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/termios",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/windows",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20260202195803-dba9d589def2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/crlib",
            "direct": false,
            "version": "v0.0.0-20241112164430-1264a2edc35b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/errors",
            "direct": false,
            "version": "v1.11.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/logtags",
            "direct": false,
            "version": "v0.0.0-20230118201751-21c54148d20b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/pebble/v2",
            "direct": false,
            "version": "v2.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/redact",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/swiss",
            "direct": false,
            "version": "v0.0.0-20251224182025-b0f6560f979b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cockroachdb/tokenbucket",
            "direct": false,
            "version": "v0.0.0-20230807174530-cc333fc44b06",
            "ecosystem": "go"
          },
          {
            "name": "github.com/coreos/go-oidc/v3",
            "direct": false,
            "version": "v3.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
            "direct": false,
            "version": "v4.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emicklei/go-restful/v3",
            "direct": false,
            "version": "v3.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane",
            "direct": false,
            "version": "v0.14.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/evanphx/json-patch/v5",
            "direct": false,
            "version": "v5.9.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/exaring/otelpgx",
            "direct": false,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fxamacker/cbor/v2",
            "direct": false,
            "version": "v2.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gaissmai/bart",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/getsentry/sentry-go",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-chi/chi/v5",
            "direct": false,
            "version": "v5.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v3",
            "direct": false,
            "version": "v3.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-kit/log",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logfmt/logfmt",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-ole/go-ole",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonreference",
            "direct": false,
            "version": "v0.21.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/cmdutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/conv",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/fileutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/loading",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/mangling",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/netutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/stringutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/typeutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/yamlutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-playground/locales",
            "direct": false,
            "version": "v0.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-playground/universal-translator",
            "direct": false,
            "version": "v0.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gobwas/glob",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang-jwt/jwt/v5",
            "direct": false,
            "version": "v5.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/snappy",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/btree",
            "direct": false,
            "version": "v1.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/cel-go",
            "direct": false,
            "version": "v0.28.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/gnostic",
            "direct": false,
            "version": "v0.7.2-0.20250814192921-e0e09f706281",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/gnostic-models",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-tpm",
            "direct": false,
            "version": "v0.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/wire",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.32.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gorilla/mux",
            "direct": false,
            "version": "v1.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gorilla/securecookie",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gosimple/unidecode",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gregjones/httpcache",
            "direct": false,
            "version": "v0.0.0-20190611155906-901d90724c79",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-hclog",
            "direct": false,
            "version": "v1.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-immutable-radix",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-metrics",
            "direct": false,
            "version": "v0.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-msgpack/v2",
            "direct": false,
            "version": "v2.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru",
            "direct": false,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/raft",
            "direct": false,
            "version": "v1.7.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgpassfile",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgservicefile",
            "direct": false,
            "version": "v0.0.0-20240606120523-5a60cdf6a761",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgx/v5",
            "direct": false,
            "version": "v5.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/puddle/v2",
            "direct": false,
            "version": "v2.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jxskiss/base62",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kylelemons/godebug",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/leodido/go-urn",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/blackmagic",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig-secp256k1",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httpcc",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httprc/v3",
            "direct": false,
            "version": "v3.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/jwx/v3",
            "direct": false,
            "version": "v3.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/option/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/libdns/libdns",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/libp2p/go-reuseport",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lufia/plan9stats",
            "direct": false,
            "version": "v0.0.0-20240513124658-fba389f38bae",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": false,
            "version": "v3.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/acmez/v3",
            "direct": false,
            "version": "v3.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/miekg/dns",
            "direct": false,
            "version": "v1.1.72",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1-0.20250507153514-87eb42fe8882",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/hashstructure/v2",
            "direct": false,
            "version": "v2.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modelcontextprotocol/go-sdk",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/natefinch/atomic",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nxadm/tail",
            "direct": false,
            "version": "v1.4.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oapi-codegen/runtime",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pires/go-proxyproto",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/browser",
            "direct": false,
            "version": "v0.0.0-20240102092130-5ac0b6a4141c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/datasource",
            "direct": false,
            "version": "v0.18.2-0.20260716182004-1c5ab56d78c6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/envoy-custom",
            "direct": false,
            "version": "v1.37.0-rc3.0.20260618180819-16ede7a56f2f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/protoutil",
            "direct": false,
            "version": "v0.0.0-20260712023948-476583c4c434",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pomerium/webauthn",
            "direct": false,
            "version": "v0.0.0-20260712023900-f47fcf774920",
            "ecosystem": "go"
          },
          {
            "name": "github.com/power-devops/perfstat",
            "direct": false,
            "version": "v0.0.0-20240221224432-82ca36839d55",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": false,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.67.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/otlptranslator",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/statsd_exporter",
            "direct": false,
            "version": "v0.22.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/raduberinde/axisds",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/raduberinde/btreemap",
            "direct": false,
            "version": "v0.0.0-20250419174037-3d62b7205d54",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rcrowley/go-metrics",
            "direct": false,
            "version": "v0.0.0-20250401214520-65e299d6c5c9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/cors",
            "direct": false,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sahilm/fuzzy",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/asm",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/encoding",
            "direct": false,
            "version": "v0.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shirou/gopsutil/v3",
            "direct": false,
            "version": "v3.24.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shoenig/go-m1cpu",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shogo82148/go-sfv",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.1-0.20240121214520-5f936abd7ae8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tchap/go-patricia/v2",
            "direct": false,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tklauser/go-sysconf",
            "direct": false,
            "version": "v0.3.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tklauser/numcpus",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tniswong/go.rfcx",
            "direct": false,
            "version": "v0.0.0-20181019234604-07783c52761f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/fastjson",
            "direct": false,
            "version": "v1.6.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vektah/gqlparser/v2",
            "direct": false,
            "version": "v2.5.36",
            "ecosystem": "go"
          },
          {
            "name": "github.com/victoriametrics/fastcache",
            "direct": false,
            "version": "v1.13.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/weastur/hclog-zerolog",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/x448/float16",
            "direct": false,
            "version": "v0.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yashtewari/glob-intersection",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yusufpapurcu/wmi",
            "direct": false,
            "version": "v1.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/blake3",
            "direct": false,
            "version": "v0.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/xxh3",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/autoprop",
            "direct": false,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/aws",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/b3",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/jaeger",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/ot",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/prometheus",
            "direct": false,
            "version": "v0.65.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/automaxprocs",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap/exp",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.4",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "gocloud.dev",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": false,
            "version": "v0.0.0-20260508232706-74f9aab9d74a",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": false,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20240903120638-7835f813f4da",
            "ecosystem": "go"
          },
          {
            "name": "gomodules.xyz/jsonpatch/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.287.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260319201613-d00831a3d3e7",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260720211330-0afa2a65878a",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260720211330-0afa2a65878a",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/evanphx/json-patch.v4",
            "direct": false,
            "version": "v4.13.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/inf.v0",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v2",
            "direct": false,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/component-base",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/klog/v2",
            "direct": false,
            "version": "v2.140.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/kube-openapi",
            "direct": false,
            "version": "v0.0.0-20260501160325-927ab1f70cd6",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/utils",
            "direct": false,
            "version": "v0.0.0-20260319190234-28399d86e0b5",
            "ecosystem": "go"
          },
          {
            "name": "oras.land/oras-go/v2",
            "direct": false,
            "version": "v2.6.1",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/json",
            "direct": false,
            "version": "v0.0.0-20250730193827-2d320260d730",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/randfill",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/structured-merge-diff/v6",
            "direct": false,
            "version": "v6.4.0",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/yaml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 338,
        "direct_count": 41,
        "indirect_count": 297
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 13,
        "merged_prs": 1082,
        "open_issues": 33,
        "closed_ratio": 0.78,
        "closed_issues": 117,
        "closed_unmerged_prs": 233
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wasaga",
          "commits": 197,
          "avatar_url": "https://avatars.githubusercontent.com/u/673131?v=4"
        },
        {
          "type": "User",
          "login": "apparitor",
          "commits": 139,
          "avatar_url": "https://avatars.githubusercontent.com/u/59841262?v=4"
        },
        {
          "type": "User",
          "login": "calebdoxsey",
          "commits": 71,
          "avatar_url": "https://avatars.githubusercontent.com/u/395272?v=4"
        },
        {
          "type": "User",
          "login": "kenjenkins",
          "commits": 50,
          "avatar_url": "https://avatars.githubusercontent.com/u/51246568?v=4"
        },
        {
          "type": "User",
          "login": "travisgroth",
          "commits": 8,
          "avatar_url": "https://avatars.githubusercontent.com/u/6198562?v=4"
        },
        {
          "type": "User",
          "login": "alexandreLamarre",
          "commits": 8,
          "avatar_url": "https://avatars.githubusercontent.com/u/56211853?v=4"
        },
        {
          "type": "User",
          "login": "renovate-bot",
          "commits": 7,
          "avatar_url": "https://avatars.githubusercontent.com/u/25180681?v=4"
        },
        {
          "type": "User",
          "login": "kralicky",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/8194899?v=4"
        },
        {
          "type": "User",
          "login": "desimone",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/1544881?v=4"
        },
        {
          "type": "User",
          "login": "adrianlzt",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/3237784?v=4"
        }
      ],
      "contributors_sampled": 17,
      "top_contributor_share": 0.397
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "backport.yaml",
        "docker-main.yaml",
        "docker-version-branches.yaml",
        "docs.yaml",
        "lint-workflows.yaml",
        "lint.yml",
        "release.yaml",
        "sync-crds-to-install.yaml",
        "test.yaml",
        "update-dependencies.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": true
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 10,
            "reason": "all changesets reviewed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 6 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 8,
            "reason": "dependency not pinned by hash detected -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "74c28fbb3fae6801e0cf066850b0972ae2424621",
        "ran_at": "2026-07-24T14:08:10Z",
        "aggregate_score": 7.5,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-24T13:03:14Z",
      "oldest_open_prs": [
        {
          "number": 292,
          "created_at": "2022-07-15T19:45:50Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 401,
          "created_at": "2022-10-22T06:44:03Z",
          "last_comment_at": "2025-05-12T18:26:53Z",
          "last_comment_author": "odoucet"
        },
        {
          "number": 619,
          "created_at": "2023-05-01T21:27:42Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 697,
          "created_at": "2023-07-19T13:26:39Z",
          "last_comment_at": "2023-07-31T13:28:25Z",
          "last_comment_author": "andsens"
        },
        {
          "number": 800,
          "created_at": "2023-11-05T20:26:08Z",
          "last_comment_at": "2023-11-29T03:41:46Z",
          "last_comment_author": "haggishunk"
        },
        {
          "number": 927,
          "created_at": "2024-03-27T20:37:07Z",
          "last_comment_at": "2024-09-30T16:33:29Z",
          "last_comment_author": "eadwu"
        },
        {
          "number": 1309,
          "created_at": "2026-01-24T21:16:03Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 1400,
          "created_at": "2026-05-05T18:26:56Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 1455,
          "created_at": "2026-06-25T23:48:47Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 1473,
          "created_at": "2026-07-13T23:07:59Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 1475,
          "created_at": "2026-07-15T19:17:44Z",
          "last_comment_at": "2026-07-15T19:20:47Z",
          "last_comment_author": "greptile-apps"
        },
        {
          "number": 1477,
          "created_at": "2026-07-17T13:00:08Z",
          "last_comment_at": "2026-07-17T13:08:17Z",
          "last_comment_author": "greptile-apps"
        },
        {
          "number": 1481,
          "created_at": "2026-07-22T16:42:08Z",
          "last_comment_at": "2026-07-22T16:43:50Z",
          "last_comment_author": "greptile-apps"
        }
      ],
      "last_merged_pr_at": "2026-07-22T02:52:27Z",
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": [
        {
          "number": 86,
          "created_at": "2020-03-21T18:15:49Z",
          "last_comment_at": "2021-11-08T15:05:12Z",
          "last_comment_author": "travisgroth"
        },
        {
          "number": 60,
          "created_at": "2021-10-05T20:18:32Z",
          "last_comment_at": "2022-01-19T20:49:18Z",
          "last_comment_author": "calebdoxsey"
        },
        {
          "number": 132,
          "created_at": "2022-01-28T00:13:22Z",
          "last_comment_at": "2023-05-31T18:48:47Z",
          "last_comment_author": "iakat"
        },
        {
          "number": 197,
          "created_at": "2022-05-04T23:52:36Z",
          "last_comment_at": "2022-05-05T16:43:33Z",
          "last_comment_author": "desimone"
        },
        {
          "number": 234,
          "created_at": "2022-06-08T18:35:00Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 244,
          "created_at": "2022-06-20T20:24:35Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 402,
          "created_at": "2022-10-23T16:07:29Z",
          "last_comment_at": "2025-05-25T15:07:50Z",
          "last_comment_author": "imax9000"
        },
        {
          "number": 477,
          "created_at": "2023-01-09T15:09:08Z",
          "last_comment_at": "2023-05-02T18:16:44Z",
          "last_comment_author": "wasaga"
        },
        {
          "number": 486,
          "created_at": "2023-01-15T02:45:13Z",
          "last_comment_at": "2023-01-17T02:41:19Z",
          "last_comment_author": "wasaga"
        },
        {
          "number": 500,
          "created_at": "2023-01-26T00:57:40Z",
          "last_comment_at": "2023-01-26T01:19:41Z",
          "last_comment_author": "wasaga"
        },
        {
          "number": 521,
          "created_at": "2023-02-10T17:28:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 522,
          "created_at": "2023-02-13T18:21:58Z",
          "last_comment_at": "2024-05-21T21:51:36Z",
          "last_comment_author": "vinc0u"
        },
        {
          "number": 529,
          "created_at": "2023-02-14T01:40:38Z",
          "last_comment_at": "2023-02-14T01:53:57Z",
          "last_comment_author": "wasaga"
        },
        {
          "number": 533,
          "created_at": "2023-02-16T17:34:30Z",
          "last_comment_at": "2023-03-31T10:22:04Z",
          "last_comment_author": "Oro"
        },
        {
          "number": 603,
          "created_at": "2023-04-21T16:40:14Z",
          "last_comment_at": "2023-04-26T20:32:23Z",
          "last_comment_author": "jehowell"
        },
        {
          "number": 630,
          "created_at": "2023-05-09T18:19:38Z",
          "last_comment_at": "2023-05-11T16:55:03Z",
          "last_comment_author": "desimone"
        },
        {
          "number": 684,
          "created_at": "2023-06-22T19:39:05Z",
          "last_comment_at": "2023-06-22T19:39:32Z",
          "last_comment_author": "wasaga"
        },
        {
          "number": 696,
          "created_at": "2023-07-19T10:32:15Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 698,
          "created_at": "2023-07-19T15:02:27Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 812,
          "created_at": "2023-11-09T18:24:32Z",
          "last_comment_at": "2023-12-19T20:24:31Z",
          "last_comment_author": "calebdoxsey"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/pomerium/ingress-controller",
    "host": "github.com",
    "name": "ingress-controller",
    "owner": "pomerium"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 80,
      "inputs": {
        "security": 80,
        "vitality": 98,
        "community": 47,
        "governance": 77,
        "engineering": 92
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 98,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 97,
            "inputs": {
              "commits_last_year": 220,
              "human_commit_share": 0.81,
              "days_since_last_push": 0,
              "active_weeks_last_year": 48
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "48/52 weeks with commits",
                "points": 33.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 48
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "220 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 220
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 64,
              "latest_release_tag": "v0.33.0",
              "releases_from_tags": false,
              "days_since_latest_release": 7,
              "mean_days_between_releases": 16.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "64 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 64
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 7 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~16.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 16.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 2,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 2 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 47,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 39,
            "inputs": {
              "forks": 22,
              "stars": 35,
              "watchers": 5,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "35 stars",
                "points": 24.8,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 35
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "22 forks",
                "points": 11,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 22
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "5 watchers",
                "points": 3.3,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 57,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 77,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 17,
              "top_contributor_share": 0.397
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 40% of commits",
                "points": 13.6,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 40
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "17 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 17
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 6 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 83,
            "inputs": {
              "merged_prs": 1082,
              "open_issues": 33,
              "closed_issues": 117,
              "issue_closed_ratio": 0.78,
              "closed_unmerged_prs": 233
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "78% of issues closed",
                "points": 36.5,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 78
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "1082/1315 decided PRs merged",
                "points": 31.5,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 1082,
                      "decided": 1315
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "all changesets reviewed",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "followers": 134,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "pomerium",
              "public_repos": 52,
              "account_age_days": 2771
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "134 followers of pomerium",
                "points": 15.3,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 134,
                      "login": "pomerium"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "52 public repos, account ~7 yr old",
                "points": 24.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 52
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 7
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/pomerium/ingress-controller"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "64 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 64
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 92,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 94,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": true
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "10 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 9.6,
                "status": "met",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "pomerium",
                "kubernetes",
                "ingress-controller"
              ],
              "has_wiki": false,
              "homepage": "https://pomerium.com",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://pomerium.com",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "3 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 80,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 75,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 7.5
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "all changesets reviewed",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 6 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 8",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 338 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 338
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 2,
              "affected_packages": 2,
              "assessed_packages": 338,
              "unassessed_packages": 0,
              "affected_by_severity": "high 1, unknown 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 338,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 6
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 73,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "81 of 81 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 81,
                      "sampled": 81
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 88,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.19
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "19 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 19,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 8",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 67498,
              "source_files_sampled": 143,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/143 source files over 60KB",
                "points": 54.6,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 143,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T14:08:36.889068Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/pomerium/ingress-controller.svg",
  "full_name": "pomerium/ingress-controller",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

Related records

Inspected repositories sharing catalogue tags or ecosystems with pomerium/ingress-controller. Read them side by side →

87zalando/skipperAn HTTP router and reverse proxy for service composition, including use cases like Kubernetes IngressExcellent91authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™Excellent91rook/rookStorage Orchestration for KubernetesExcellent91hashicorp/consulConsul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.Excellent90containerd/containerdAn open and reliable container runtimeExcellent89kyverno/kyvernoUnified Policy as CodeExcellent

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — Go.