sigstore / fulcio

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

Each point covers 5 days.

Full resolved dependency set from the GitHub dependency graph: 47 direct and 127 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 171 packages, which also include development and test pins that never ship: 6 carry known advisories, of which 2 are direct. 3 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 13670,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 771232,
        "Shell": 3487,
        "Python": 2733,
        "Makefile": 8679,
        "Dockerfile": 1554
      },
      "pushed_at": "2026-07-27T02:33:39Z",
      "created_at": "2021-02-23T15:19:44Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-22T20:40:27Z",
      "description": "Sigstore OIDC PKI",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://sigstore.dev",
      "name": "sigstore",
      "type": "Organization",
      "login": "sigstore",
      "company": null,
      "location": "United States of America",
      "followers": 1687,
      "avatar_url": "https://avatars.githubusercontent.com/u/71096353?v=4",
      "created_at": "2020-09-10T18:28:56Z",
      "is_verified": null,
      "public_repos": 66,
      "account_age_days": 2146
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.8.8",
          "kind": "patch",
          "published_at": "2026-07-08T16:32:48Z"
        },
        {
          "tag": "v1.8.7",
          "kind": "patch",
          "published_at": "2026-05-29T16:50:39Z"
        },
        {
          "tag": "v1.8.6",
          "kind": "patch",
          "published_at": "2026-05-26T22:40:39Z"
        },
        {
          "tag": "v1.8.5",
          "kind": "patch",
          "published_at": "2026-01-12T18:23:29Z"
        },
        {
          "tag": "v1.8.4",
          "kind": "patch",
          "published_at": "2025-12-16T17:08:42Z"
        },
        {
          "tag": "v1.8.3",
          "kind": "patch",
          "published_at": "2025-12-04T17:59:04Z"
        },
        {
          "tag": "v1.8.2",
          "kind": "patch",
          "published_at": "2025-11-19T18:06:20Z"
        },
        {
          "tag": "v1.8.1",
          "kind": "patch",
          "published_at": "2025-11-07T01:12:17Z"
        },
        {
          "tag": "v1.7.1",
          "kind": "patch",
          "published_at": "2025-04-24T14:55:12Z"
        },
        {
          "tag": "v1.7.0",
          "kind": "minor",
          "published_at": "2025-04-11T17:19:04Z"
        },
        {
          "tag": "v1.6.6",
          "kind": "patch",
          "published_at": "2025-01-22T19:02:57Z"
        },
        {
          "tag": "v1.6.5",
          "kind": "patch",
          "published_at": "2024-10-09T14:17:26Z"
        },
        {
          "tag": "v1.6.4",
          "kind": "patch",
          "published_at": "2024-09-04T20:00:10Z"
        },
        {
          "tag": "v1.6.3",
          "kind": "patch",
          "published_at": "2024-08-23T16:33:39Z"
        },
        {
          "tag": "v1.6.2",
          "kind": "patch",
          "published_at": "2024-08-15T19:12:50Z"
        },
        {
          "tag": "v1.6.1",
          "kind": "patch",
          "published_at": "2024-08-14T17:43:16Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2024-08-06T19:18:35Z"
        },
        {
          "tag": "v1.5.1",
          "kind": "patch",
          "published_at": "2024-07-11T01:15:21Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2024-07-09T22:30:34Z"
        },
        {
          "tag": "v1.4.5",
          "kind": "patch",
          "published_at": "2024-04-05T20:03:27Z"
        },
        {
          "tag": "v1.4.4",
          "kind": "patch",
          "published_at": "2024-02-28T22:17:07Z"
        },
        {
          "tag": "v1.4.3",
          "kind": "patch",
          "published_at": "2023-10-11T23:49:49Z"
        },
        {
          "tag": "v1.4.2",
          "kind": "patch",
          "published_at": "2023-10-11T14:10:19Z"
        },
        {
          "tag": "v1.4.1",
          "kind": "patch",
          "published_at": "2023-10-09T23:28:09Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2023-07-19T21:28:06Z"
        },
        {
          "tag": "v1.3.4",
          "kind": "patch",
          "published_at": "2023-07-11T16:29:01Z"
        },
        {
          "tag": "v1.3.3",
          "kind": "patch",
          "published_at": "2023-07-08T11:12:44Z"
        },
        {
          "tag": "v1.3.2",
          "kind": "patch",
          "published_at": "2023-06-28T19:37:16Z"
        },
        {
          "tag": "v1.3.1",
          "kind": "patch",
          "published_at": "2023-05-03T21:38:19Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2023-05-01T20:50:57Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2023-03-27T22:52:38Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2023-02-16T20:44:55Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2022-10-17T22:00:43Z"
        },
        {
          "tag": "v1.0.0-rc.0",
          "kind": "prerelease",
          "published_at": "2022-10-07T21:44:02Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2022-09-30T12:43:03Z"
        },
        {
          "tag": "v0.5.4",
          "kind": "patch",
          "published_at": "2022-09-30T12:25:04Z"
        },
        {
          "tag": "v0.5.3",
          "kind": "patch",
          "published_at": "2022-09-30T12:13:38Z"
        },
        {
          "tag": "v0.5.2",
          "kind": "patch",
          "published_at": "2022-07-25T08:55:13Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2022-07-08T16:56:41Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2022-06-07T08:19:31Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2022-05-03T13:00:17Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2022-04-23T22:28:23Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2022-04-06T15:23:06Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2022-03-14T11:49:27Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2021-07-26T15:37:24Z"
        },
        {
          "tag": "0.1.0",
          "kind": "minor",
          "published_at": "2021-07-07T09:39:09Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "b149971b3042731622b3679b421150cb7e8f9186",
          "body": "Signed-off-by: Mateusz Jakobsche <mateusz.jakobsche@buddy.works>",
          "is_bot": false,
          "headline": "add development environments for buddy.works (#2409)",
          "author_name": "Mateusz Jakobsche",
          "author_login": "MateuszJakobscheBDY",
          "committed_at": "2026-07-22T20:40:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8b0be61cff017e67006ac3ce18802d49390c11dc",
          "body": "…notation (#2406)",
          "is_bot": false,
          "headline": "fix(ciprovider): format large whole-number claims without scientific …",
          "author_name": "Arpit Jain",
          "author_login": "arpitjain099",
          "committed_at": "2026-07-22T04:09:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "66ec2cbd537200fe34491748470915af3015eaed",
          "body": "Remove chainops.dev as it unused\n\nSigned-off-by: Appu <appu@google.com>",
          "is_bot": false,
          "headline": "Update config.yaml (#2407)",
          "author_name": "Appu",
          "author_login": "loosebazooka",
          "committed_at": "2026-07-21T15:24:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d394f41b281f65bed55e5dad5c78956078fec3b",
          "body": null,
          "is_bot": false,
          "headline": "change run invocation uri for buddy.works (#2403)",
          "author_name": "Mateusz Jakobsche",
          "author_login": "MateuszJakobscheBDY",
          "committed_at": "2026-07-15T14:15:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "850b6b1cd55fa831958120fc1807ee64a0ffcec1",
          "body": "* buddy.works provider\n\nSigned-off-by: Mateusz Jakobsche <mateusz.jakobsche@buddy.works>\n\n* change contact email to support in config.yaml\n\nSigned-off-by: Mateusz Jakobsche <141125937+MateuszJakobscheBDY@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Mateusz Jakobsche <mateusz.jakobsche@buddy.works>\nSigned-off-by: Mateusz Jakobsche <141125937+MateuszJakobscheBDY@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add Buddy OIDC provider (#2371)",
          "author_name": "Mateusz Jakobsche",
          "author_login": "MateuszJakobscheBDY",
          "committed_at": "2026-07-08T17:03:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a783aca51abce93aca863fac2addf0194880e065",
          "body": "certificate-transparency-go bundles the important information from a CT\nlog error in the Body field of the error[1], not the Error field, so the\n.Error() method does not necessarily capture the problem and results in\ncryptic log messages like 'got HTTP status \"500 Internal Server Error\"'.\nThis chang\n[…]\nthe crucial data and adds it to the log.\n\n[1] https://github.com/google/certificate-transparency-go/blob/v1.3.3/jsonclient/client.go#L117-L126\n\nSigned-off-by: Colleen Murphy <colleenmurphy@google.com>",
          "is_bot": false,
          "headline": "Include CT log error body in logs (#2393)",
          "author_name": "Colleen Murphy",
          "author_login": "cmurphy",
          "committed_at": "2026-07-07T18:30:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "965cdddc90299409ebba952f41b3be8233b2a7b2",
          "body": "Signed-off-by: Carlos Panato <ctadeu@gmail.com>",
          "is_bot": false,
          "headline": "update builder to use go1.26.4 (#2388)",
          "author_name": "Carlos Tadeu Panato Junior",
          "author_login": "cpanato",
          "committed_at": "2026-07-07T16:00:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "654e688937a6bbd656681e1ea23d6b09f86677d9",
          "body": "Bumps the go_modules group with 1 update in the /hack/tools directory: [golang.org/x/net](https://github.com/golang/net).\n\n\nUpdates `golang.org/x/net` from 0.48.0 to 0.55.0\n- [Commits](https://github.com/golang/net/compare/v0.48.0...v0.55.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x\n[…]\net\n  dependency-version: 0.55.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang.org/x/net (#2389)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T21:34:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "462c070d0ffe13b144f8798c2ad678c37e86a406",
          "body": "Bumps the all group with 1 update in the / directory: nginx.\n\n\nUpdates `nginx` from 1.31.1 to 1.31.2\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.31.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx in the all group across 1 directory (#2381)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T21:33:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ccc07820dc77a743f498d8a2a35b65ffa675c4a5",
          "body": "Bumps golang from `68cb6d6` to `792443b`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `68cb6d6` to `792443b` (#2379)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T21:27:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e0f11949c85ad2ca9e2fb964465395b535fa3bb",
          "body": "…391)\n\n* build(deps): bump the all group across 1 directory with 5 updates\n\nBumps the all group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` | `6.5.0` |\n| [ko-build/setup-ko](https://github.com/ko-\n[…]\nden <8418760+Hayden-IO@users.noreply.github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 5 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T21:27:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "61e2802f9fce1c7d9b8613118e2432ff363ac049",
          "body": "…390)\n\nBumps the all group with 2 updates in the / directory: [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk) and [github.com/ThalesGroup/crypto11](https://github.com/ThalesGroup/crypto11).\n\n\nUpdates `chainguard.dev/sdk` from 0.1.55 to 0.1.103\n- [Release notes](https://github.com/chaingu\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 5 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T21:24:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "80d8405e84eb76d60d99363aa2782631c86418ba",
          "body": "* Add --ct-log-origin flag\n\nSince the move to TesseraCT, the logs are clogged with the warning \"AddPreChain\nthe request was received on a URL which is not prefixed with the configured\norigin\". This is because Fulcio is accessing the CT log in-cluster from its\nKubernetes service name instead of its p\n[…]\no. This addresses\nthe CI failures that have come with the new ko release.\n\nSigned-off-by: Colleen Murphy <colleenmurphy@google.com>\n\n---------\n\nSigned-off-by: Colleen Murphy <colleenmurphy@google.com>",
          "is_bot": false,
          "headline": "Add --ct-log-origin flag (#2392)",
          "author_name": "Colleen Murphy",
          "author_login": "cmurphy",
          "committed_at": "2026-07-06T21:07:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7074b709ec6309d863f8789bdd32a75b49c5e127",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b43\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2383)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T00:42:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "16cc54efe85eb2f5ef7f7e51494cb344e14690a0",
          "body": "Fulcio's API advertises RSA_PSS as a supported algorithm, but the algorithm\nfield is not used when parsing the public key, and RSA keys are treated as\nRSA PKCS#1 v1.5 rather than RSA-PSS.\n\nDocument both behaviours in fulcio.proto (and the regenerated output) so the\nAPI contract is clear to clients until this is corrected in a future major\nversion, as discussed in the issue.\n\nFixes #1858\n\nSigned-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>",
          "is_bot": false,
          "headline": "docs: clarify RSA_PSS algorithm and ignored field in proto (#2378)",
          "author_name": "Ogulcan Aydogan",
          "author_login": "ogulcanaydogan",
          "committed_at": "2026-06-16T21:26:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b2c67d809db4a6fa4b4d04940fea0878151d8d7",
          "body": "…d (#2377)\n\nAdding --hsm-key-label flag to fulcio serve command for pkcs11ca backend. This flag allows users to specify a custom PKCS#11 key label when the signing key was not generated with the default PKCS11CA label. Defaults to PKCS11CA for backward compatibility.\n\nSigned-off-by: jacobJMayhew <168750320+jacobJMayhew@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update fulcio to have configurable hsm-caroot-id rather than hardcode…",
          "author_name": "jacobJMayhew",
          "author_login": "jacobJMayhew",
          "committed_at": "2026-06-15T20:49:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "602f013b7387aa3e5e58f6846b972aabc9bf7913",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.280.0 to 0.282.0 (#2359)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-15T14:56:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e3bcb366362e2aed2c650bb4c0a21696cc7dd853",
          "body": "Bumps the all group with 1 update: golang.\n\n\nUpdates `golang` from 1.26.3 to 1.26.4\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from 1.26.3 to 1.26.4 in the all group (#2366)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-15T13:08:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "18a955ada90779d3628277e7818eab2cb42bf345",
          "body": "Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0.\n- [Release notes](https://github.com/codecov/codecov-action/releases)\n- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/codecov/codecov-action/c\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 (#2369)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-15T13:08:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e2273cf2166515a931dccae4cd6bdf42e0ff086e",
          "body": "Bumps nginx from 1.31.1 to 1.31.1.\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.31.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.31.1 to 1.31.1 (#2373)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-15T13:07:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bead92e575c9193da40943b25a08291879687266",
          "body": "…374)\n\nBumps the all group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions).\n\n\nUpdates `actions/checkout` from 6.\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 3 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-15T13:07:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e808f25e3cf03675316d2e0f74f790b4c190bd61",
          "body": "…(#2360)\n\nBumps [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) from 1.24.0 to 1.25.0.\n- [Release notes](https://github.com/googleapis/google-cloud-go/releases)\n- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)\n- [Commits](http\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump cloud.google.com/go/security from 1.24.0 to 1.25.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-01T08:57:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d6004f1a1a7e24fa569a1e1285dce77b8af8455a",
          "body": "…(#2361)\n\nBumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.67.5 to 0.68.0.\n- [Release notes](https://github.com/prometheus/common/releases)\n- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/prometheus/common/com\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-01T08:42:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5eb80090fd8179757ef716b2d28b0d68831437d",
          "body": "Bumps goa.design/goa/v3 from 3.26.0 to 3.27.0.\n\n---\nupdated-dependencies:\n- dependency-name: goa.design/goa/v3\n  dependency-version: 3.27.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump goa.design/goa/v3 from 3.26.0 to 3.27.0 (#2362)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-01T08:42:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "362e11d2196f1e1a44999689a9daaf4246dc9372",
          "body": "This drops a dependency for pemutil that's now implemented in s/s's\ncryptoutils and using the std library. Unfortunately we can't downgrade\nthe Go mod version directive due to other dependencies at the moment.\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Bump sigstore/sigstore, simplify dep tree (#2357)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-05-29T20:56:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8254f95cac5652eed07420c360775b2ae513053b",
          "body": "…ath (#2356)\n\nGate the in-cluster CA + bearer-token attachment in httpClientForIssuer on\nthe issuer being directly listed in OIDCIssuers, in addition to the existing\nmatch against k8sIssuerURL. Clusters whose --service-account-issuer is not\nliterally https://kubernetes.default.svc (e.g. K3s, which u\n[…]\ne the bearer\ntoken, because the new gate trusts only directly-listed OIDCIssuers entries\n(and the default k8sIssuerURL itself).\n\nFixes #2355.\n\nSigned-off-by: Kevin Monroe <kevin.monroe@chainguard.dev>",
          "is_bot": false,
          "headline": "Allow directly-configured Kubernetes issuers to use in-cluster auth p…",
          "author_name": "Kevin W Monroe",
          "author_login": "kwmonroe",
          "committed_at": "2026-05-29T16:24:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d614dd4d761bfba2402508a0110501797567a7c1",
          "body": "…(#2346)\n\nBumps [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) from 1.19.2 to 1.24.0.\n- [Release notes](https://github.com/googleapis/google-cloud-go/releases)\n- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)\n- [Commits](http\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump cloud.google.com/go/security from 1.19.2 to 1.24.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-28T13:47:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92cfd9344946a96fef27b3801e2142536ddcdcc4",
          "body": "* build(deps): bump protocolbuffers/protobuf from 34.1 to 35.0\n\nBumps [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) from 34.1 to 35.0.\n- [Release notes](https://github.com/protocolbuffers/protobuf/releases)\n- [Commits](https://github.com/protocolbuffers/protobuf/compare/v34\n[…]\n-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com>",
          "is_bot": true,
          "headline": "build(deps): bump protocolbuffers/protobuf from 34.1 to 35.0 (#2351)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-27T15:42:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "378c654f48c3bafdced04ead7010aab2cb4c6ca1",
          "body": "… (#2354)\n\nSecures the outbound OIDC discovery request flow against SSRF, JWKS substitution, and credential leakage.\n\nBlocks cross-host redirects: Configures a custom CheckRedirect callback on all OIDC discovery clients to\nreject redirects that attempt to leave the original issuer's host boundary. S\n[…]\nost exactly matches the expected issuer's host.\nThis prevents token leakage during both redirect scenarios and cross-host JWKS URIs.\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Block cross-host redirects and restrict bearer token to expected host…",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-05-26T22:21:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a5d3e32ae9fda3bddbc2e3e7ffd9e40c5fe5c5f",
          "body": "Signed-off-by: Carlos Panato <ctadeu@gmail.com>",
          "is_bot": false,
          "headline": "bump builder image to use go1.26.3 (#2353)",
          "author_name": "Carlos Tadeu Panato Junior",
          "author_login": "cpanato",
          "committed_at": "2026-05-26T16:29:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a05982e14a35ffa5dcd0b89519059eb4f155461c",
          "body": "Bumps [go.step.sm/crypto](https://github.com/smallstep/crypto) from 0.75.0 to 0.81.0.\n- [Release notes](https://github.com/smallstep/crypto/releases)\n- [Commits](https://github.com/smallstep/crypto/compare/v0.75.0...v0.81.0)\n\n---\nupdated-dependencies:\n- dependency-name: go.step.sm/crypto\n  dependenc\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump go.step.sm/crypto from 0.75.0 to 0.81.0 (#2348)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-25T14:26:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dfa63a85423b180af4c54d114dad7a31a3d8b14b",
          "body": "Bumps golang from `313faae` to `2d6c802`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `313faae` to `2d6c802` (#2344)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-25T14:19:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7b3a3449ea5807c34b8d0461072b84b77faf09ff",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.279.0 to 0.280.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.279.0 to 0.280.0 (#2349)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-25T14:18:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9290f7f1b4738fa05e4a3c493ea824074d715414",
          "body": "Bumps the all group with 2 updates: [codecov/codecov-action](https://github.com/codecov/codecov-action) and [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).\n\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n- [Release notes](https://github.com/codecov/codecov-a\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group with 2 updates (#2350)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-25T14:18:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "423d535d2718eec70e3aef8fa27926c43a15ecea",
          "body": "Bumps the all group with 1 update: nginx.\n\n\nUpdates `nginx` from 1.31.0 to 1.31.1\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.31.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.31.0 to 1.31.1 in the all group (#2352)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-25T14:16:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "19a3f8e1d61826fe8fde99e60e8f080d727e408e",
          "body": "…337)\n\nBumps the all group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk) | `0.1.54` | `0.1.55` |\n| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.5` | `1.10.6` |\n| [github.co\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 6 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T12:57:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b597cec1be945eb1d5175ece3e1dc70141ae6cd",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.276.0 to 0.279.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.276.0 to 0.279.0 (#2338)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T11:49:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0d1dc797ca3b3ee99edd19edf81ad9282382359c",
          "body": "Bumps the all group with 1 update: nginx.\n\n\nUpdates `nginx` from 1.29.8 to 1.31.0\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.31.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.29.8 to 1.31.0 in the all group (#2342)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T11:21:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "373c23efa891d53386908c774b24a436c81fbb58",
          "body": "…#2340)\n\nBumps [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) from 1.9.0 to 1.10.1.\n- [Release notes](https://github.com/fsnotify/fsnotify/releases)\n- [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/fsnotify/fsnotify/compa\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T11:21:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "99be49ca129fa1c6e70ce32f317006bc402e5749",
          "body": "Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.27.1 to 1.28.0.\n- [Release notes](https://github.com/uber-go/zap/releases)\n- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/uber-go/zap/compare/v1.27.1...v1.28.0)\n\n---\nupdated-dependen\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 (#2341)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T11:21:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c316a5bda66cfe5cb3263464b9abf90c7e73e6d",
          "body": "Bumps [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) from 2.28.0 to 2.29.0.\n- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)\n- [Commits](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.28.0...v2.29.0)\n\n---\nupdated-depen\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#2339)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T11:20:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "82f3bc718df351bcbb0507a94d6defd0f1031eab",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump golang from `2981696` to `313faae` (#2336)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T06:34:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eef26612da3738c7ca8554a17e8befaab4883b95",
          "body": null,
          "is_bot": false,
          "headline": "build(deps): bump github.com/tink-crypto/tink-go-awskms/v2 to v3 (#2335)",
          "author_name": "Andrew Haines",
          "author_login": "haines",
          "committed_at": "2026-05-17T23:19:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4793d589c0d35f901f7266dff4db198727eaa90e",
          "body": "…330)\n\nBumps the all group with 4 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go), [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [chainguard-dev/actions](https:/\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 4 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-13T13:03:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0fd2957856a8e108119e89115823c2389cca9b61",
          "body": "Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.2 to 6.0.0.\n- [Release notes](https://github.com/codecov/codecov-action/releases)\n- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/codecov/codecov-action/c\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#2321)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-13T12:40:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c2288061c402f560d8356dbfcfaf4f1879d8ff9",
          "body": "Bumps the all group with 1 update in the / directory: golang.\n\n\nUpdates `golang` from 1.26.1 to 1.26.3\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang in the all group across 1 directory (#2323)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-13T12:40:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0db8cf481f8edc691dd37d6005b284cdf7b41b85",
          "body": "Bumps the all group with 1 update in the / directory: nginx.\n\n\nUpdates `nginx` from 1.29.7 to 1.29.8\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.29.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx in the all group across 1 directory (#2326)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-12T22:13:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac26d593bb2d49f6c31e65a89f837702eed9903d",
          "body": "Dependency github.com/ThalesIgnite/crypto11 is\nnow github.com/ThalesGroup/crypto11\n\nFixes #2329\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update crypto11 dependency (#2331)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-05-12T03:42:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0df784402f5f82d20526d316d0005b7bcd0711a2",
          "body": "Bumps goa.design/goa/v3 from 3.24.1 to 3.26.0.\n\n---\nupdated-dependencies:\n- dependency-name: goa.design/goa/v3\n  dependency-version: 3.25.3\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump goa.design/goa/v3 from 3.24.1 to 3.26.0 (#2318)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T21:42:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7c15ea7872de69b75f8b8eff80ea28a8d1947c86",
          "body": "…333)\n\nBumps the all group with 3 updates in the / directory: [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk), [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) and [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils).\n\n\nUpdates `ch\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 7 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T21:19:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5614efa28b05f198a2a1ad979492ac16c8acb1f3",
          "body": "…#2313)\n\nBumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.4 to 3.0.5.\n- [Release notes](https://github.com/go-jose/go-jose/releases)\n- [Commits](https://github.com/go-jose/go-jose/compare/v3.0.4...v3.0.5)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-j\n[…]\n/v3\n  dependency-version: 3.0.5\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T21:19:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7604ae09f6d70f80cbf8756e1943feaa8e267dbf",
          "body": "…#2314)\n\nBumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.\n- [Release notes](https://github.com/go-jose/go-jose/releases)\n- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-j\n[…]\nendency-version: 4.1.4\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T21:07:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a754bd82688235f3cb32fc51e4054738dae8f9c7",
          "body": "…(#2322)\n\nBumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.42.0 to 1.43.0.\n- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)\n- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)\n- [Commits\n[…]\ndk\n  dependency-version: 1.43.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T21:06:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "26b83c802cecb4a8d185541e51da0c5e9ac2c8e5",
          "body": "The GHA-based token fetcher has unfortunately become unstable and\ndoesn't run as frequently as needed. We've moved to a Cloud Run-based\ngenerator.\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update untrusted OIDC token for e2e testing (#2332)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-05-11T21:06:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e2a4f56e4badd55ffbee3f8e2c5c96117040215",
          "body": "Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add changelog for v1.8.6 (#2312)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-05-04T05:51:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e4e457d0ecb2c4acf74da4a166471defb3371b3",
          "body": "Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "deps: Bump protobuf to 34.x (#2311)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-05-04T05:34:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1a1fd5526aa692bf30c07e1dbda046cc2db096f",
          "body": "Bumps the go_modules group with 1 update in the /hack/tools directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).\n\n\nUpdates `google.golang.org/grpc` from 1.75.1 to 1.79.3\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v\n[…]\n\n  dependency-type: indirect\n  dependency-group: go_modules\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/grpc (#2302)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-31T16:54:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "31bc2cba32fba87475e1ccdf31433a3a75e472ec",
          "body": "…293)\n\n* build(deps): bump the all group across 1 directory with 2 updates\n\nBumps the all group with 2 updates in the / directory: golang and dexidp/dex.\n\n\nUpdates `golang` from 1.25.7 to 1.26.0\n\nUpdates `dexidp/dex` from v2.44.0 to v2.45.0\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  depe\n[…]\nt@github.com>\nSigned-off-by: Bob Callaway <bcallaway@google.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Bob Callaway <bcallaway@google.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 2 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-31T16:53:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5710d13ca14aaf116cb9d6b827fc7cb3fcb57871",
          "body": "Bumps the all group with 1 update: nginx.\n\n\nUpdates `nginx` from 1.29.6 to 1.29.7\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.29.7\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.29.6 to 1.29.7 in the all group (#2310)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-31T16:51:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae4f4578f1a7fb220c205fe599bd221daf8bb604",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76f\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#2296)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-31T16:22:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "39b48e6a8f2efe1809a1b19b4301666c3fd36667",
          "body": "Sometimes identities have a different identifier that isn't captured by existing certificates, usually\nbecause the identifier isn't useful as a human friendly reference. For example - GCP accounts have\nan opaque numerical identifier.\n\nThat said, subject is particularly useful to preserve since OIDC \n[…]\ng subject as-is. While this may result in some duplicative\ndata for some providers, this helps give a consistent reference point across OIDC issuers.\n\nSigned-off-by: Billy Lynch <billy@chainguard.dev>",
          "is_bot": false,
          "headline": "Include raw subject in certificates (#2307)",
          "author_name": "Billy Lynch",
          "author_login": "wlynch",
          "committed_at": "2026-03-31T14:58:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "14bfd83660109ae8a6137327aedcda7adfeed604",
          "body": "…2308)\n\nBumps the all group with 9 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [chainguard.dev/go-grpc-kit](https://github.com/chainguard-dev/go-grpc-kit) | `0.17.15` | `0.17.17` |\n| [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk) | `0.1.45` | `0.1.52` |\n| \n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 13 updates (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-30T06:23:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f7893addf2cb110982806dff4c6561d1f96811f1",
          "body": "…309)\n\nBumps the all group with 3 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go), [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions).\n\n\nUpdates `actions/setup-go` from \n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 3 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-30T06:18:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b683519248cf9ee45abe22b29b63aa5124f882ba",
          "body": "Bumps the all group with 1 update: nginx.\n\n\nUpdates `nginx` from 1.29.5 to 1.29.6\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.29.6\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.29.5 to 1.29.6 in the all group (#2301)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T20:34:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39df9f9ccba243fb5c7f094696f392430839a5e1",
          "body": "Just some stylistic cleanup.\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Run go fix on codebase (#2299)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-03-12T22:09:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0b31403a3e12440360c3d2e847f596fa23f394a",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump chainguard-dev/actions in the all group (#2291)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-23T07:04:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ad38b6aa78cede8f0eb5ea24eabc0149a83f4ec",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#2289)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T07:31:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b71c80aa4a806f23f37ea86b3a4d4d8143771aef",
          "body": "Bumps the all group with 1 update: [chainguard-dev/actions](https://github.com/chainguard-dev/actions).\n\n\nUpdates `chainguard-dev/actions` from 1.5.16 to 1.6.1\n- [Release notes](https://github.com/chainguard-dev/actions/releases)\n- [Commits](https://github.com/chainguard-dev/actions/compare/eba358c5\n[…]\ne-type: version-update:semver-minor\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump chainguard-dev/actions in the all group (#2288)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-16T09:22:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3ea8aa18286b23631a9a2171a0c1be2c40fb1b0a",
          "body": "Signed-off-by: Carlos Panato <ctadeu@gmail.com>",
          "is_bot": false,
          "headline": "update golang builder to use go1.25.7 (#2285)",
          "author_name": "Carlos Tadeu Panato Junior",
          "author_login": "cpanato",
          "committed_at": "2026-02-10T10:59:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e38d4eb86703a38d9b785d4b7f649254029a90f",
          "body": "Bumps the all group with 1 update: nginx.\n\n\nUpdates `nginx` from 1.29.4 to 1.29.5\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.29.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.29.4 to 1.29.5 in the all group (#2284)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-09T10:33:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "26bfdcc37f012edd89f4884730faa875f7f1b2d6",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump chainguard-dev/actions in the all group (#2283)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-09T09:20:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45611323c4e9756b216c9764e802545dafefbfdb",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump golang from 1.25.6 to 1.25.7 in the all group (#2282)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-09T07:25:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "72f44c5926116508cf6362ac002ea042176d8914",
          "body": "…277)\n\nBumps the all group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go), [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) and [chainguard-dev/actions](https://github.com/chai\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 4 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-04T12:36:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4afd3f39216dcca4639545bcc2bf3f25491d6813",
          "body": "…(#2274)\n\nBumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.10.3 to 1.10.4.\n- [Release notes](https://github.com/sigstore/sigstore/releases)\n- [Commits](https://github.com/sigstore/sigstore/compare/v1.10.3...v1.10.4)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nndency-version: 1.10.4\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-04T12:34:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0fb4c12a1c7bd621aef6a5304f407946bba53be9",
          "body": "Bumps goa.design/goa/v3 from 3.23.4 to 3.24.1.\n\n---\nupdated-dependencies:\n- dependency-name: goa.design/goa/v3\n  dependency-version: 3.24.1\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump goa.design/goa/v3 from 3.23.4 to 3.24.1 (#2270)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-04T12:34:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee91ce6871a96216f985e14d7432c10a5bcd65d0",
          "body": "Bumps nginx from 1.29.4 to 1.29.4.\n\n---\nupdated-dependencies:\n- dependency-name: nginx\n  dependency-version: 1.29.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump nginx from 1.29.4 to 1.29.4 (#2262)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-04T12:33:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "80eaed06e911cdfd26dd18f02b8e862f7f6ee453",
          "body": "Previously, as long as any part of the string matched the regex, it would pass.\nBecause of the recently reported SSRF, we added anchors to require that the regex\nmatch the full string.\n\nThis configuration update will match what's rolled out to prod, and adds\ntests to demonstrate everything is working as intended.\n\nRef https://github.com/sigstore/fulcio/issues/2265\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update Azure AKS OIDC issuer URL regex (#2266)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-02-02T12:25:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "72854b92db0daec3dd69f9dce83cd4e9b7294bbb",
          "body": "Bumps the all group with 1 update: golang.\n\n\nUpdates `golang` from 1.25.5 to 1.25.6\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.25.6\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#2275)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-02T12:24:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0002d09f43590f531d823a763bae96d33fccdc2",
          "body": null,
          "is_bot": false,
          "headline": "typo  it should have been a plural (#2280)",
          "author_name": "mitchell amihod",
          "author_login": "meeech",
          "committed_at": "2026-01-30T04:06:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "88071971722da51b197c4db657c93f4ba94275a0",
          "body": "yq is already installed on GHA ubuntu runners\n\nSigned-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Don't install yq (#2279)",
          "author_name": "Hayden",
          "author_login": "Hayden-IO",
          "committed_at": "2026-01-29T17:49:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "001376a50932095cf4b6e65299ed2d29abe83524",
          "body": "* feat: add new root issuer for circleci\n\nSigned-off-by: meeech <4623+meeech@users.noreply.github.com>\n\n* Update the info  to take into account new easier to work with redirect\n\nBefore we were pointing to an API endpoint where you would get all the jobs in that workflow, and then you could manually \n[…]\n\n\nhttps://app.circleci.com/workflow/{workflow-uuid}/job/{job-uuid}\nSigned-off-by: meeech <4623+meeech@users.noreply.github.com>\n\n---------\n\nSigned-off-by: meeech <4623+meeech@users.noreply.github.com>",
          "is_bot": false,
          "headline": "add support for new circleci root issuer (#2278)",
          "author_name": "mitchell amihod",
          "author_login": "meeech",
          "committed_at": "2026-01-29T16:49:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4265ac2e974e24c5c486a36c83c7a90f60b4da2",
          "body": "Signed-off-by: Colleen Murphy <colleenmurphy@google.com>",
          "is_bot": false,
          "headline": "Use a root with key usages specified (#2267)",
          "author_name": "Colleen Murphy",
          "author_login": "cmurphy",
          "committed_at": "2026-01-15T23:55:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eaae2f2be56df9dea5f9b439ec81bedae4c0978d",
          "body": "…2263)\n\nWithout these anchors, URLs where the issuer is not the host could be\nmatched. This can result in server side request forgery, where the OIDC\nlibrary will query the well-known or JWKS URIs.\n\nSigned-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add anchors when matching meta issuer regexp (GHSA-59jp-pj84-45mr) (#…",
          "author_name": "Hayden",
          "author_login": null,
          "committed_at": "2026-01-12T18:09:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9325775f9646bf8f9e1d592b70d437469665e5ee",
          "body": "Signed-off-by: Hayden <haydentherapper@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update changelog for v1.8.5 (#2264)",
          "author_name": "Hayden",
          "author_login": null,
          "committed_at": "2026-01-12T18:09:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b23705dfa2c780a35c4c2431ee1d410a21e59bc4",
          "body": null,
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.258.0 to 0.259.0 (#2260)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-12T06:59:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9e8841d1a25c3ac04431bc3f5cb6e464e305d423",
          "body": "Bumps golang from `a22b2e6` to `36b4f45`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.25.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `a22b2e6` to `36b4f45` (#2251)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-08T22:52:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c135881b636773dbff529d2a7ef3a39a1fc40fd",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...b7c566a772e6b6bfb58ed0dc25\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#2253)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-08T22:52:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c823ae9f2d21467d7a296a44ad68a7a3b3f47ca",
          "body": "…259)\n\nBumps the all group with 2 updates in the / directory: [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) and [github.com/prometheus/common](https://github.com/prometheus/common).\n\n\nUpdates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.27.3 to 2.2\n[…]\ne-type: version-update:semver-minor\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 4 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-08T22:52:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c15246a31188dc787d23de75e690e51e596d30f8",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.257.0 to 0.258.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#2252)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-08T22:29:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f2e48e187c5e872375f641c2ed11b7d78324c73f",
          "body": "TesseraCT is producing its own images so we don't need to maintain our\nown in scaffolding.\n\nThis also updates the image to v0.1.1.\n\nSigned-off-by: Colleen Murphy <colleenmurphy@google.com>",
          "is_bot": false,
          "headline": "Use transparency-dev tesseract image (#2250)",
          "author_name": "Colleen Murphy",
          "author_login": "cmurphy",
          "committed_at": "2026-01-08T22:27:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9e26cb46dc2022c3b561b7386442a26490f3f9bc",
          "body": "TesseraCT is a write-only service, it needs a separate web server to\nserve tiles and checkpoints. Add an nginx container to the dev\nenvironment to support the read path for monitoring.\n\nSigned-off-by: Colleen Murphy <colleenmurphy@google.com>",
          "is_bot": false,
          "headline": "Add read service for CT log (#2258)",
          "author_name": "Colleen Murphy",
          "author_login": "cmurphy",
          "committed_at": "2026-01-05T21:40:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7bff3d6a63891a9267719ea982b2f05349e6b8f3",
          "body": "* Switch to go.yaml.in/yaml/v3\n\nThis seems to be a drop-in replacement for the now-unmaintained\ngopkg.in/yaml.v3. Note that this is still pulled in as an indirect\ndependency.\n\nAlso replace the deprecated kubeval util with kubeconform.\n\nFixes #2015\n\nSigned-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Switch to go.yaml.in/yaml/v3 (#2257)",
          "author_name": "Hayden",
          "author_login": null,
          "committed_at": "2026-01-04T16:20:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ef0dcfa4f73a47e8c1351032c985ca2812c5e3e",
          "body": "Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Changelog for v1.8.4 (#2249)",
          "author_name": "Hayden",
          "author_login": null,
          "committed_at": "2025-12-16T17:15:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5bfa34740fc579523e2da9825ea575227331c6f",
          "body": "….0 (#2246)\n\nBumps [github.com/tink-crypto/tink-go/v2](https://github.com/tink-crypto/tink-go) from 2.5.0 to 2.6.0.\n- [Release notes](https://github.com/tink-crypto/tink-go/releases)\n- [Commits](https://github.com/tink-crypto/tink-go/compare/v2.5.0...v2.6.0)\n\n---\nupdated-dependencies:\n- dependency-n\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/tink-crypto/tink-go/v2 from 2.5.0 to 2.6…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-15T18:34:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0039c980ab58e8cabf38d62fb80a607b5f21c0da",
          "body": "Bumps goa.design/goa/v3 from 3.22.6 to 3.23.4.\n\n---\nupdated-dependencies:\n- dependency-name: goa.design/goa/v3\n  dependency-version: 3.23.4\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump goa.design/goa/v3 from 3.22.6 to 3.23.4 (#2245)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-15T17:19:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a432f030f1dca4d088f1777f07947a85d1750cd",
          "body": "Bumps [go.step.sm/crypto](https://github.com/smallstep/crypto) from 0.74.0 to 0.75.0.\n- [Release notes](https://github.com/smallstep/crypto/releases)\n- [Commits](https://github.com/smallstep/crypto/compare/v0.74.0...v0.75.0)\n\n---\nupdated-dependencies:\n- dependency-name: go.step.sm/crypto\n  dependenc\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump go.step.sm/crypto from 0.74.0 to 0.75.0 (#2238)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-15T17:19:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f3aba4a94150cad7eaa7dc0445e8cdf6cb037c23",
          "body": "…247)\n\nBumps the all group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [codecov/codecov-action](https://github.com/codecov/codecov-action), [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) and [golangci/golangci-lint-action](http\n[…]\ne-type: version-update:semver-minor\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group across 1 directory with 4 updates (#2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-15T17:11:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e66a4c6f47d4052c7b38b84f081b26ca3191deb0",
          "body": "Bumps the all group with 8 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [chainguard.dev/sdk](https://github.com/chainguard-dev/sdk) | `0.1.44` | `0.1.45` |\n| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.0` | `1.10.3` |\n| [github.com/sigstore/sigstore/pkg/si\n[…]\ne-type: version-update:semver-patch\n  dependency-group: all\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the all group with 8 updates (#2244)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-15T17:10:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a846db6473f4be95443f3772914a15cc156be7b6",
          "body": "Bumps golang from `20b91ed` to `a22b2e6`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.25.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `20b91ed` to `a22b2e6` (#2243)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-15T07:42:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5a012f5e4f9617fe649b08ec8531d1e8256577e4",
          "body": "Signed-off-by: mitchell <mitchell@circleci.com>",
          "is_bot": false,
          "headline": "update Run Invocation URI for circleci (#2242)",
          "author_name": "mitchell amihod",
          "author_login": "meeech",
          "committed_at": "2025-12-11T00:58:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 46,
      "commits_last_year": 194,
      "latest_release_at": "2026-07-08T16:32:48Z",
      "latest_release_tag": "v1.8.8",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 41,
      "days_since_latest_release": 19,
      "mean_days_between_releases": 50.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/sigstore/fulcio",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/sigstore/fulcio",
          "is_deprecated": false,
          "latest_version": "v1.8.8",
          "repository_url": "https://github.com/sigstore/fulcio",
          "versions_count": 46,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-07T18:30:18Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 20
        }
      ]
    },
    "popularity": {
      "forks": 185,
      "stars": 863,
      "watchers": 17,
      "fork_history": {
        "days": [
          {
            "date": "2021-03-01",
            "count": 1
          },
          {
            "date": "2021-03-07",
            "count": 1
          },
          {
            "date": "2021-03-08",
            "count": 1
          },
          {
            "date": "2021-03-10",
            "count": 1
          },
          {
            "date": "2021-03-11",
            "count": 1
          },
          {
            "date": "2021-03-23",
            "count": 1
          },
          {
            "date": "2021-04-07",
            "count": 1
          },
          {
            "date": "2021-04-08",
            "count": 1
          },
          {
            "date": "2021-04-14",
            "count": 1
          },
          {
            "date": "2021-04-19",
            "count": 1
          },
          {
            "date": "2021-05-02",
            "count": 1
          },
          {
            "date": "2021-06-02",
            "count": 1
          },
          {
            "date": "2021-06-08",
            "count": 1
          },
          {
            "date": "2021-07-15",
            "count": 1
          },
          {
            "date": "2021-07-19",
            "count": 1
          },
          {
            "date": "2021-08-12",
            "count": 1
          },
          {
            "date": "2021-08-24",
            "count": 1
          },
          {
            "date": "2021-09-03",
            "count": 1
          },
          {
            "date": "2021-09-07",
            "count": 1
          },
          {
            "date": "2021-09-09",
            "count": 1
          },
          {
            "date": "2021-09-15",
            "count": 1
          },
          {
            "date": "2021-09-17",
            "count": 1
          },
          {
            "date": "2021-09-30",
            "count": 1
          },
          {
            "date": "2021-10-05",
            "count": 1
          },
          {
            "date": "2021-10-19",
            "count": 1
          },
          {
            "date": "2021-10-23",
            "count": 1
          },
          {
            "date": "2021-10-30",
            "count": 1
          },
          {
            "date": "2021-11-05",
            "count": 1
          },
          {
            "date": "2021-11-08",
            "count": 1
          },
          {
            "date": "2021-11-12",
            "count": 1
          },
          {
            "date": "2021-11-24",
            "count": 1
          },
          {
            "date": "2021-12-10",
            "count": 1
          },
          {
            "date": "2021-12-15",
            "count": 1
          },
          {
            "date": "2021-12-16",
            "count": 1
          },
          {
            "date": "2022-01-01",
            "count": 1
          },
          {
            "date": "2022-01-03",
            "count": 1
          },
          {
            "date": "2022-01-12",
            "count": 1
          },
          {
            "date": "2022-01-21",
            "count": 1
          },
          {
            "date": "2022-01-25",
            "count": 1
          },
          {
            "date": "2022-01-26",
            "count": 1
          },
          {
            "date": "2022-01-30",
            "count": 1
          },
          {
            "date": "2022-02-03",
            "count": 1
          },
          {
            "date": "2022-02-04",
            "count": 1
          },
          {
            "date": "2022-02-10",
            "count": 1
          },
          {
            "date": "2022-02-17",
            "count": 1
          },
          {
            "date": "2022-02-18",
            "count": 1
          },
          {
            "date": "2022-03-08",
            "count": 1
          },
          {
            "date": "2022-03-18",
            "count": 1
          },
          {
            "date": "2022-03-22",
            "count": 1
          },
          {
            "date": "2022-04-01",
            "count": 1
          },
          {
            "date": "2022-04-21",
            "count": 1
          },
          {
            "date": "2022-05-10",
            "count": 1
          },
          {
            "date": "2022-05-14",
            "count": 1
          },
          {
            "date": "2022-05-26",
            "count": 1
          },
          {
            "date": "2022-05-31",
            "count": 1
          },
          {
            "date": "2022-06-02",
            "count": 1
          },
          {
            "date": "2022-06-04",
            "count": 1
          },
          {
            "date": "2022-06-14",
            "count": 1
          },
          {
            "date": "2022-06-29",
            "count": 1
          },
          {
            "date": "2022-07-20",
            "count": 1
          },
          {
            "date": "2022-07-27",
            "count": 1
          },
          {
            "date": "2022-08-05",
            "count": 1
          },
          {
            "date": "2022-08-16",
            "count": 1
          },
          {
            "date": "2022-09-05",
            "count": 1
          },
          {
            "date": "2022-09-06",
            "count": 1
          },
          {
            "date": "2022-09-15",
            "count": 1
          },
          {
            "date": "2022-09-18",
            "count": 1
          },
          {
            "date": "2022-09-26",
            "count": 1
          },
          {
            "date": "2022-10-21",
            "count": 1
          },
          {
            "date": "2022-10-23",
            "count": 1
          },
          {
            "date": "2022-10-26",
            "count": 1
          },
          {
            "date": "2022-11-06",
            "count": 1
          },
          {
            "date": "2022-11-16",
            "count": 1
          },
          {
            "date": "2022-12-18",
            "count": 1
          },
          {
            "date": "2023-01-04",
            "count": 1
          },
          {
            "date": "2023-02-02",
            "count": 1
          },
          {
            "date": "2023-02-07",
            "count": 1
          },
          {
            "date": "2023-02-16",
            "count": 1
          },
          {
            "date": "2023-02-28",
            "count": 1
          },
          {
            "date": "2023-03-08",
            "count": 1
          },
          {
            "date": "2023-03-29",
            "count": 1
          },
          {
            "date": "2023-04-05",
            "count": 1
          },
          {
            "date": "2023-04-13",
            "count": 1
          },
          {
            "date": "2023-04-30",
            "count": 1
          },
          {
            "date": "2023-05-01",
            "count": 1
          },
          {
            "date": "2023-05-04",
            "count": 1
          },
          {
            "date": "2023-05-31",
            "count": 1
          },
          {
            "date": "2023-06-02",
            "count": 1
          },
          {
            "date": "2023-06-10",
            "count": 1
          },
          {
            "date": "2023-07-07",
            "count": 1
          },
          {
            "date": "2023-07-26",
            "count": 1
          },
          {
            "date": "2023-07-27",
            "count": 1
          },
          {
            "date": "2023-08-01",
            "count": 1
          },
          {
            "date": "2023-08-06",
            "count": 1
          },
          {
            "date": "2023-08-08",
            "count": 1
          },
          {
            "date": "2023-08-17",
            "count": 1
          },
          {
            "date": "2023-08-23",
            "count": 1
          },
          {
            "date": "2023-08-24",
            "count": 1
          },
          {
            "date": "2023-09-07",
            "count": 1
          },
          {
            "date": "2023-09-28",
            "count": 1
          },
          {
            "date": "2023-11-07",
            "count": 1
          },
          {
            "date": "2023-12-13",
            "count": 1
          },
          {
            "date": "2024-01-17",
            "count": 1
          },
          {
            "date": "2024-02-13",
            "count": 1
          },
          {
            "date": "2024-02-19",
            "count": 1
          },
          {
            "date": "2024-02-27",
            "count": 1
          },
          {
            "date": "2024-02-28",
            "count": 1
          },
          {
            "date": "2024-03-04",
            "count": 1
          },
          {
            "date": "2024-03-11",
            "count": 1
          },
          {
            "date": "2024-03-24",
            "count": 1
          },
          {
            "date": "2024-03-26",
            "count": 1
          },
          {
            "date": "2024-04-10",
            "count": 1
          },
          {
            "date": "2024-04-21",
            "count": 1
          },
          {
            "date": "2024-05-13",
            "count": 1
          },
          {
            "date": "2024-05-26",
            "count": 1
          },
          {
            "date": "2024-06-03",
            "count": 1
          },
          {
            "date": "2024-06-07",
            "count": 1
          },
          {
            "date": "2024-06-08",
            "count": 1
          },
          {
            "date": "2024-06-21",
            "count": 1
          },
          {
            "date": "2024-07-01",
            "count": 1
          },
          {
            "date": "2024-07-14",
            "count": 1
          },
          {
            "date": "2024-07-28",
            "count": 1
          },
          {
            "date": "2024-08-12",
            "count": 1
          },
          {
            "date": "2024-08-16",
            "count": 1
          },
          {
            "date": "2024-09-10",
            "count": 1
          },
          {
            "date": "2024-09-19",
            "count": 1
          },
          {
            "date": "2024-09-22",
            "count": 1
          },
          {
            "date": "2024-10-03",
            "count": 1
          },
          {
            "date": "2024-11-20",
            "count": 1
          },
          {
            "date": "2024-12-19",
            "count": 1
          },
          {
            "date": "2024-12-26",
            "count": 1
          },
          {
            "date": "2025-01-26",
            "count": 1
          },
          {
            "date": "2025-03-12",
            "count": 1
          },
          {
            "date": "2025-03-23",
            "count": 1
          },
          {
            "date": "2025-03-26",
            "count": 1
          },
          {
            "date": "2025-03-27",
            "count": 1
          },
          {
            "date": "2025-04-03",
            "count": 1
          },
          {
            "date": "2025-04-17",
            "count": 1
          },
          {
            "date": "2025-05-14",
            "count": 1
          },
          {
            "date": "2025-06-09",
            "count": 1
          },
          {
            "date": "2025-06-30",
            "count": 1
          },
          {
            "date": "2025-07-11",
            "count": 1
          },
          {
            "date": "2025-07-12",
            "count": 1
          },
          {
            "date": "2025-07-22",
            "count": 1
          },
          {
            "date": "2025-07-30",
            "count": 1
          },
          {
            "date": "2025-07-31",
            "count": 1
          },
          {
            "date": "2025-08-11",
            "count": 1
          },
          {
            "date": "2025-08-23",
            "count": 1
          },
          {
            "date": "2025-09-03",
            "count": 1
          },
          {
            "date": "2025-09-27",
            "count": 1
          },
          {
            "date": "2025-10-30",
            "count": 1
          },
          {
            "date": "2025-11-21",
            "count": 1
          },
          {
            "date": "2025-11-23",
            "count": 1
          },
          {
            "date": "2025-12-31",
            "count": 1
          },
          {
            "date": "2026-01-18",
            "count": 1
          },
          {
            "date": "2026-01-20",
            "count": 1
          },
          {
            "date": "2026-01-27",
            "count": 1
          },
          {
            "date": "2026-02-13",
            "count": 1
          },
          {
            "date": "2026-04-17",
            "count": 1
          },
          {
            "date": "2026-05-02",
            "count": 1
          },
          {
            "date": "2026-05-12",
            "count": 1
          },
          {
            "date": "2026-05-15",
            "count": 1
          },
          {
            "date": "2026-05-17",
            "count": 1
          },
          {
            "date": "2026-05-22",
            "count": 1
          },
          {
            "date": "2026-05-27",
            "count": 2
          },
          {
            "date": "2026-05-29",
            "count": 1
          },
          {
            "date": "2026-06-06",
            "count": 1
          },
          {
            "date": "2026-06-07",
            "count": 1
          },
          {
            "date": "2026-06-09",
            "count": 1
          },
          {
            "date": "2026-06-15",
            "count": 1
          },
          {
            "date": "2026-06-16",
            "count": 1
          },
          {
            "date": "2026-06-25",
            "count": 1
          },
          {
            "date": "2026-07-01",
            "count": 1
          },
          {
            "date": "2026-07-10",
            "count": 1
          },
          {
            "date": "2026-07-20",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 176,
        "total_forks": 185
      },
      "star_history": null,
      "open_issues_and_prs": 47
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [
        "fulcio.proto",
        "fulcio_legacy.proto",
        "third_party/googleapis/google/api/annotations.proto",
        "third_party/googleapis/google/api/field_behavior.proto",
        "third_party/googleapis/google/api/http.proto",
        "third_party/googleapis/google/api/httpbody.proto",
        "third_party/googleapis/google/protobuf/any.proto",
        "third_party/googleapis/google/protobuf/api.proto",
        "third_party/googleapis/google/protobuf/compiler/plugin.proto",
        "third_party/googleapis/google/protobuf/descriptor.proto",
        "third_party/googleapis/google/protobuf/duration.proto",
        "third_party/googleapis/google/protobuf/empty.proto",
        "third_party/googleapis/google/protobuf/field_mask.proto",
        "third_party/googleapis/google/protobuf/source_context.proto",
        "third_party/googleapis/google/protobuf/struct.proto",
        "third_party/googleapis/google/protobuf/timestamp.proto",
        "third_party/googleapis/google/protobuf/type.proto",
        "third_party/googleapis/google/protobuf/wrappers.proto",
        "third_party/googleapis/protoc-gen-openapiv2/options/annotations.proto",
        "third_party/googleapis/protoc-gen-openapiv2/options/openapiv2.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod",
        "hack/tools/go.mod"
      ],
      "largest_source_bytes": 86598,
      "source_files_sampled": 130,
      "oversized_source_files": 1,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.79.3",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf",
              "GO-2026-6061"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 2,
            "oldest_advisory_days": 5
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.81.1",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf",
              "GO-2026-6061"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 2,
            "oldest_advisory_days": 5
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 19
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.55.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5942"
            ],
            "fixed_version": "0.56.0",
            "advisory_count": 1,
            "oldest_advisory_days": 13
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 13
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 13
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 4,
          "critical": 2
        },
        "advisory_count": 8,
        "affected_count": 6,
        "assessed_count": 171,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 3,
        "direct_affected_count": 2
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "chainguard.dev/go-grpc-kit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.17.17"
        },
        {
          "name": "chainguard.dev/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.103"
        },
        {
          "name": "cloud.google.com/go/security",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.25.0"
        },
        {
          "name": "github.com/PaesslerAG/jsonpath",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1"
        },
        {
          "name": "github.com/ThalesGroup/crypto11",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.2"
        },
        {
          "name": "github.com/asaskevich/govalidator",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20210307081110-f21760c49a8d"
        },
        {
          "name": "github.com/coreos/go-oidc/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.19.0"
        },
        {
          "name": "github.com/fsnotify/fsnotify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.1"
        },
        {
          "name": "github.com/go-jose/go-jose/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.1.4"
        },
        {
          "name": "github.com/google/certificate-transparency-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.3"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/grpc-ecosystem/go-grpc-middleware",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/grpc-ecosystem/go-grpc-prometheus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.1-0.20210315223345-82c243799c99"
        },
        {
          "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.29.0"
        },
        {
          "name": "github.com/hashicorp/golang-lru/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.7"
        },
        {
          "name": "github.com/magiconair/properties",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.10"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.2"
        },
        {
          "name": "github.com/prometheus/client_model",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.2"
        },
        {
          "name": "github.com/prometheus/common",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.68.0"
        },
        {
          "name": "github.com/rs/cors",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/sigstore/protobuf-specs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.1"
        },
        {
          "name": "github.com/sigstore/sigstore",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.8"
        },
        {
          "name": "github.com/sigstore/sigstore/pkg/signature/kms/aws",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.8"
        },
        {
          "name": "github.com/sigstore/sigstore/pkg/signature/kms/azure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.8"
        },
        {
          "name": "github.com/sigstore/sigstore/pkg/signature/kms/gcp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.8"
        },
        {
          "name": "github.com/sigstore/sigstore/pkg/signature/kms/hashivault",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.8"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.10"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.20.1"
        },
        {
          "name": "github.com/spiffe/go-spiffe/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.6.0"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/tink-crypto/tink-go-awskms/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.0"
        },
        {
          "name": "github.com/tink-crypto/tink-go-gcpkms/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.2.0"
        },
        {
          "name": "github.com/tink-crypto/tink-go/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.6.0"
        },
        {
          "name": "go.uber.org/zap",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.28.0"
        },
        {
          "name": "go.yaml.in/yaml/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.4"
        },
        {
          "name": "goa.design/goa/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.27.0"
        },
        {
          "name": "google.golang.org/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.286.0"
        },
        {
          "name": "google.golang.org/genproto/googleapis/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260526163538-3dc84a4a5aaa"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.81.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.12-0.20260120151049-f2248ac996af"
        },
        {
          "name": "sigs.k8s.io/release-utils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.12.4"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "chainguard.dev/go-grpc-kit",
            "direct": true,
            "version": "v0.17.17",
            "ecosystem": "go"
          },
          {
            "name": "chainguard.dev/sdk",
            "direct": true,
            "version": "v0.1.103",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/security",
            "direct": true,
            "version": "v1.25.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/asaskevich/govalidator",
            "direct": true,
            "version": "v0.0.0-20210307081110-f21760c49a8d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/coreos/go-oidc/v3",
            "direct": true,
            "version": "v3.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": true,
            "version": "v1.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": true,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/certificate-transparency-go",
            "direct": true,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-middleware",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-prometheus",
            "direct": true,
            "version": "v1.2.1-0.20210315223345-82c243799c99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": true,
            "version": "v2.27.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": true,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": true,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": true,
            "version": "v1.8.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/paesslerag/jsonpath",
            "direct": true,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": true,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": true,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": true,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/cors",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/protobuf-specs",
            "direct": true,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore",
            "direct": true,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore/pkg/signature/kms/aws",
            "direct": true,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore/pkg/signature/kms/azure",
            "direct": true,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore/pkg/signature/kms/gcp",
            "direct": true,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore/pkg/signature/kms/hashivault",
            "direct": true,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": true,
            "version": "v1.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": true,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/thalesgroup/crypto11",
            "direct": true,
            "version": "v1.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tink-crypto/tink-go-awskms/v3",
            "direct": true,
            "version": "v3.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tink-crypto/tink-go-gcpkms/v2",
            "direct": true,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tink-crypto/tink-go/v2",
            "direct": true,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": true,
            "version": "v1.28.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": true,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "goa.design/goa/v3",
            "direct": true,
            "version": "v3.27.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": true,
            "version": "v0.286.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": true,
            "version": "v0.0.0-20251202230838-ff82c1b0f217",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": true,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.79.3",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.81.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.10",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/release-utils",
            "direct": true,
            "version": "v0.12.4",
            "ecosystem": "go"
          },
          {
            "name": "bitbucket.org/creachadair/stringset",
            "direct": false,
            "version": "v0.0.12",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/kms",
            "direct": false,
            "version": "v1.31.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/longrunning",
            "direct": false,
            "version": "v0.6.7",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/longrunning",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/kms",
            "direct": false,
            "version": "v1.51.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.0.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.30.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.35.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.42.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azcore",
            "direct": false,
            "version": "v1.21.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azidentity",
            "direct": false,
            "version": "v1.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/internal",
            "direct": false,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/azkeys",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/internal",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azuread/microsoft-authentication-library-for-go",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": false,
            "version": "v4.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bufbuild/protocompile",
            "direct": false,
            "version": "v0.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v4",
            "direct": false,
            "version": "v4.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/chainguard-dev/clog",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/common-nighthawk/go-figure",
            "direct": false,
            "version": "v0.0.0-20210622060536-734e95fb86be",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gertd/go-pluralize",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang-jwt/jwt/v5",
            "direct": false,
            "version": "v5.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/protobuf",
            "direct": false,
            "version": "v1.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": false,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/api-linter/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-middleware/v2",
            "direct": false,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-retryablehttp",
            "direct": false,
            "version": "v0.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-rootcerts",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-secure-stdlib/parseutil",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-secure-stdlib/strutil",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-sockaddr",
            "direct": false,
            "version": "v1.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl",
            "direct": false,
            "version": "v1.0.1-vault-7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/vault/api",
            "direct": false,
            "version": "v1.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jellydator/ttlcache/v3",
            "direct": false,
            "version": "v3.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kelseyhightower/envconfig",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kylelemons/godebug",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/letsencrypt/boulder",
            "direct": false,
            "version": "v0.20260309.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/miekg/pkcs11",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/mapstructure",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/natefinch/atomic",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": false,
            "version": "v0.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/paesslerag/gval",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/browser",
            "direct": false,
            "version": "v0.0.0-20240102092130-5ac0b6a4141c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ryanuber/go-glob",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/secure-systems-lab/go-securesystemslib",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": false,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stoewer/go-strcase",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/thales-e-security/pool",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/titanous/rocacheck",
            "direct": false,
            "version": "v0.0.0-20171023193734-afe73141d399",
            "ecosystem": "go"
          },
          {
            "name": "github.com/youmark/pkcs8",
            "direct": false,
            "version": "v0.0.0-20240726163527-a2c0da244d78",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.67.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260406210006-6f92a3bedf2d",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20251202230838-ff82c1b0f217",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260610212136-7ab31c22f7ad",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc/cmd/protoc-gen-go-grpc",
            "direct": false,
            "version": "v1.5.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "cryptography",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "locust",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pyjwt",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 174,
        "direct_count": 47,
        "indirect_count": 127
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 12,
        "merged_prs": 1885,
        "open_issues": 35,
        "closed_ratio": 0.866,
        "closed_issues": 227,
        "closed_unmerged_prs": 245
      },
      "bus_factor": 4,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "Hayden-IO",
          "commits": 110,
          "avatar_url": "https://avatars.githubusercontent.com/u/8418760?v=4"
        },
        {
          "type": "User",
          "login": "cpanato",
          "commits": 89,
          "avatar_url": "https://avatars.githubusercontent.com/u/4115580?v=4"
        },
        {
          "type": "User",
          "login": "bobcallaway",
          "commits": 67,
          "avatar_url": "https://avatars.githubusercontent.com/u/2845093?v=4"
        },
        {
          "type": "User",
          "login": "nsmith5",
          "commits": 36,
          "avatar_url": "https://avatars.githubusercontent.com/u/12156185?v=4"
        },
        {
          "type": "User",
          "login": "lukehinds",
          "commits": 34,
          "avatar_url": "https://avatars.githubusercontent.com/u/7058938?v=4"
        },
        {
          "type": "User",
          "login": "mattmoor",
          "commits": 24,
          "avatar_url": "https://avatars.githubusercontent.com/u/2442466?v=4"
        },
        {
          "type": "User",
          "login": "priyawadhwa",
          "commits": 18,
          "avatar_url": "https://avatars.githubusercontent.com/u/10676490?v=4"
        },
        {
          "type": "User",
          "login": "cmurphy",
          "commits": 12,
          "avatar_url": "https://avatars.githubusercontent.com/u/1220710?v=4"
        },
        {
          "type": "User",
          "login": "javanlacerda",
          "commits": 12,
          "avatar_url": "https://avatars.githubusercontent.com/u/23180089?v=4"
        },
        {
          "type": "User",
          "login": "vaikas",
          "commits": 10,
          "avatar_url": "https://avatars.githubusercontent.com/u/11279988?v=4"
        }
      ],
      "contributors_sampled": 94,
      "top_contributor_share": 0.202
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "check-oidc-issuers.yml",
        "codeql-analysis.yml",
        "container-build.yml",
        "cut-release.yml",
        "depsreview.yml",
        "e2e.yml",
        "main.yml",
        "protoc-dependabot-hack.yml",
        "scorecard_action.yml",
        "validate-release.yml",
        "verify-k8s.yml",
        "verify.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 10,
            "reason": "all changesets reviewed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 52 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 9,
            "reason": "dependency not pinned by hash detected -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 8,
            "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 6,
            "reason": "4 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "b149971b3042731622b3679b421150cb7e8f9186",
        "ran_at": "2026-07-27T20:14:43Z",
        "aggregate_score": 7.8,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-27T11:55:57Z",
      "oldest_open_prs": [
        {
          "number": 2375,
          "created_at": "2026-06-15T07:34:19Z",
          "last_comment_at": "2026-06-15T07:37:44Z",
          "last_comment_author": "codecov"
        },
        {
          "number": 2398,
          "created_at": "2026-07-13T02:32:37Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2399,
          "created_at": "2026-07-13T02:32:49Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2400,
          "created_at": "2026-07-13T02:32:59Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2401,
          "created_at": "2026-07-13T02:33:14Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2404,
          "created_at": "2026-07-20T02:32:33Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2405,
          "created_at": "2026-07-20T02:33:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2410,
          "created_at": "2026-07-22T21:08:12Z",
          "last_comment_at": "2026-07-22T21:11:06Z",
          "last_comment_author": "codecov"
        },
        {
          "number": 2411,
          "created_at": "2026-07-25T02:35:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2412,
          "created_at": "2026-07-25T02:35:27Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2413,
          "created_at": "2026-07-27T02:32:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2414,
          "created_at": "2026-07-27T02:33:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-22T20:40:10Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 174,
          "created_at": "2021-08-28T21:40:19Z",
          "last_comment_at": "2021-09-01T20:34:55Z",
          "last_comment_author": "bbockelm"
        },
        {
          "number": 304,
          "created_at": "2021-12-31T20:20:32Z",
          "last_comment_at": "2022-01-23T08:16:41Z",
          "last_comment_author": "lukehinds"
        },
        {
          "number": 371,
          "created_at": "2022-02-01T17:48:20Z",
          "last_comment_at": "2022-03-09T15:44:03Z",
          "last_comment_author": "znewman01"
        },
        {
          "number": 475,
          "created_at": "2022-03-15T00:19:29Z",
          "last_comment_at": "2025-01-24T22:08:18Z",
          "last_comment_author": "Hayden-IO"
        },
        {
          "number": 639,
          "created_at": "2022-06-03T21:40:24Z",
          "last_comment_at": "2022-09-01T20:08:22Z",
          "last_comment_author": "znewman01"
        },
        {
          "number": 740,
          "created_at": "2022-08-16T12:21:09Z",
          "last_comment_at": "2023-06-20T21:08:53Z",
          "last_comment_author": "Hayden-IO"
        },
        {
          "number": 817,
          "created_at": "2022-10-07T19:02:41Z",
          "last_comment_at": "2022-10-24T04:56:56Z",
          "last_comment_author": "Hayden-IO"
        },
        {
          "number": 891,
          "created_at": "2022-11-16T20:11:37Z",
          "last_comment_at": "2023-11-26T11:38:39Z",
          "last_comment_author": "Hayden-IO"
        },
        {
          "number": 974,
          "created_at": "2023-01-23T22:14:35Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 975,
          "created_at": "2023-01-23T22:41:47Z",
          "last_comment_at": "2025-02-26T14:57:57Z",
          "last_comment_author": "kommendorkapten"
        },
        {
          "number": 1055,
          "created_at": "2023-03-15T00:06:54Z",
          "last_comment_at": "2026-07-01T22:00:02Z",
          "last_comment_author": "EthanHeilman"
        },
        {
          "number": 1056,
          "created_at": "2023-03-15T00:11:42Z",
          "last_comment_at": "2023-03-15T01:03:04Z",
          "last_comment_author": "OR13"
        },
        {
          "number": 1071,
          "created_at": "2023-03-17T21:39:21Z",
          "last_comment_at": "2023-11-21T08:25:44Z",
          "last_comment_author": "Hayden-IO"
        },
        {
          "number": 1086,
          "created_at": "2023-03-28T13:43:22Z",
          "last_comment_at": "2023-03-29T15:23:55Z",
          "last_comment_author": "znewman01"
        },
        {
          "number": 1176,
          "created_at": "2023-05-19T17:57:06Z",
          "last_comment_at": "2023-05-19T18:40:16Z",
          "last_comment_author": "Edward13ruf"
        },
        {
          "number": 1178,
          "created_at": "2023-05-21T08:38:01Z",
          "last_comment_at": "2023-08-10T11:12:08Z",
          "last_comment_author": "Edward13ruf"
        },
        {
          "number": 1182,
          "created_at": "2023-05-24T18:40:17Z",
          "last_comment_at": "2023-05-25T20:42:44Z",
          "last_comment_author": "marshall007"
        },
        {
          "number": 1257,
          "created_at": "2023-07-04T06:57:24Z",
          "last_comment_at": "2023-07-10T08:36:16Z",
          "last_comment_author": "sled"
        },
        {
          "number": 1280,
          "created_at": "2023-07-17T13:22:53Z",
          "last_comment_at": "2023-07-19T15:53:46Z",
          "last_comment_author": "Hayden-IO"
        },
        {
          "number": 1283,
          "created_at": "2023-07-18T18:28:24Z",
          "last_comment_at": "2024-06-04T18:47:48Z",
          "last_comment_author": "loosebazooka"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/sigstore/fulcio",
    "host": "github.com",
    "name": "fulcio",
    "owner": "sigstore"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 84,
      "inputs": {
        "security": 75,
        "vitality": 92,
        "community": 82,
        "governance": 87,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 92,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "commits_last_year": 194,
              "human_commit_share": 0.34,
              "days_since_last_push": 0,
              "active_weeks_last_year": 41
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "41/52 weeks with commits",
                "points": 28.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 41
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "194 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 194
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 91,
            "inputs": {
              "releases_count": 46,
              "latest_release_tag": "v1.8.8",
              "releases_from_tags": false,
              "days_since_latest_release": 19,
              "mean_days_between_releases": 50.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "46 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 46
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 19 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 19
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~50.3 days",
                "points": 19.8,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 50.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 4,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 4 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "good",
        "name": "Community & Adoption",
        "value": 82,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "good",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "forks": 185,
              "stars": 863,
              "watchers": 17,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "863 stars",
                "points": 47.6,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 863
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "185 forks",
                "points": 18.9,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 185
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "17 watchers",
                "points": 6.7,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 17
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "excellent",
        "name": "Sustainability & Governance",
        "value": 87,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "excellent",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "bus_factor": 4,
              "contributors_sampled": 94,
              "top_contributor_share": 0.202
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "4 contributor(s) cover half of all commits",
                "points": 43.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 20% of commits",
                "points": 18,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 20
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "94 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 94
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 52 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 89,
            "inputs": {
              "merged_prs": 1885,
              "open_issues": 35,
              "closed_issues": 227,
              "issue_closed_ratio": 0.866,
              "closed_unmerged_prs": 245
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "87% of issues closed",
                "points": 40.5,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 87
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "1885/2130 decided PRs merged",
                "points": 33.9,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 1885,
                      "decided": 2130
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "all changesets reviewed",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 78,
            "inputs": {
              "followers": 1687,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "sigstore",
              "public_repos": 66,
              "account_age_days": 2146
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1,687 followers of sigstore",
                "points": 23.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1687,
                      "login": "sigstore"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "66 public repos, account ~5 yr old",
                "points": 24.8,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 66
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 5
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/sigstore/fulcio"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 20
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 20 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 20
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "46 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 46
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "12 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 12
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 75,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 78,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 7.8
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "all changesets reviewed",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 52 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 9",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "4 existing vulnerabilities detected",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 171 resolved dependencies against OSV; 3 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 171
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 3
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 64,
            "inputs": {
              "source": "osv",
              "advisories": 8,
              "affected_packages": 6,
              "assessed_packages": 171,
              "unassessed_packages": 3,
              "affected_by_severity": "critical 2, unknown 4",
              "direct_affected_packages": 2
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "2 affected: google.golang.org/grpc v1.79.3 (critical 9.1), google.golang.org/grpc v1.81.1 (critical 9.1)",
                "points": 7.8,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 2,
                      "packages": "google.golang.org/grpc v1.79.3 (critical 9.1), google.golang.org/grpc v1.81.1 (critical 9.1)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 171,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 19
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 75,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "34 of 34 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 34,
                      "sampled": 34
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 89,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod",
                "hack/tools/go.mod"
              ],
              "dependency_bot_commit_share": 0.66
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "66 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 66,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 9",
                "points": 9,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 86598,
              "source_files_sampled": 130,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/130 source files over 60KB",
                "points": 54.6,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 130,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "good",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": [
                "fulcio.proto",
                "fulcio_legacy.proto",
                "third_party/googleapis/google/api/annotations.proto",
                "third_party/googleapis/google/api/field_behavior.proto",
                "third_party/googleapis/google/api/http.proto",
                "third_party/googleapis/google/api/httpbody.proto",
                "third_party/googleapis/google/protobuf/any.proto",
                "third_party/googleapis/google/protobuf/api.proto",
                "third_party/googleapis/google/protobuf/compiler/plugin.proto",
                "third_party/googleapis/google/protobuf/descriptor.proto",
                "third_party/googleapis/google/protobuf/duration.proto",
                "third_party/googleapis/google/protobuf/empty.proto",
                "third_party/googleapis/google/protobuf/field_mask.proto",
                "third_party/googleapis/google/protobuf/source_context.proto",
                "third_party/googleapis/google/protobuf/struct.proto",
                "third_party/googleapis/google/protobuf/timestamp.proto",
                "third_party/googleapis/google/protobuf/type.proto",
                "third_party/googleapis/google/protobuf/wrappers.proto",
                "third_party/googleapis/protoc-gen-openapiv2/options/annotations.proto",
                "third_party/googleapis/protoc-gen-openapiv2/options/openapiv2.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "fulcio.proto, fulcio_legacy.proto, third_party/googleapis/google/api/annotations.proto, third_party/googleapis/google/api/field_behavior.proto, third_party/googleapis/google/api/http.proto, third_party/googleapis/google/api/httpbody.proto, third_party/googleapis/google/protobuf/any.proto, third_party/googleapis/google/protobuf/api.proto, third_party/googleapis/google/protobuf/compiler/plugin.proto, third_party/googleapis/google/protobuf/descriptor.proto, third_party/googleapis/google/protobuf/duration.proto, third_party/googleapis/google/protobuf/empty.proto, third_party/googleapis/google/protobuf/field_mask.proto, third_party/googleapis/google/protobuf/source_context.proto, third_party/googleapis/google/protobuf/struct.proto, third_party/googleapis/google/protobuf/timestamp.proto, third_party/googleapis/google/protobuf/type.proto, third_party/googleapis/google/protobuf/wrappers.proto, third_party/googleapis/protoc-gen-openapiv2/options/annotations.proto, third_party/googleapis/protoc-gen-openapiv2/options/openapiv2.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "fulcio.proto, fulcio_legacy.proto, third_party/googleapis/google/api/annotations.proto, third_party/googleapis/google/api/field_behavior.proto, third_party/googleapis/google/api/http.proto, third_party/googleapis/google/api/httpbody.proto, third_party/googleapis/google/protobuf/any.proto, third_party/googleapis/google/protobuf/api.proto, third_party/googleapis/google/protobuf/compiler/plugin.proto, third_party/googleapis/google/protobuf/descriptor.proto, third_party/googleapis/google/protobuf/duration.proto, third_party/googleapis/google/protobuf/empty.proto, third_party/googleapis/google/protobuf/field_mask.proto, third_party/googleapis/google/protobuf/source_context.proto, third_party/googleapis/google/protobuf/struct.proto, third_party/googleapis/google/protobuf/timestamp.proto, third_party/googleapis/google/protobuf/type.proto, third_party/googleapis/google/protobuf/wrappers.proto, third_party/googleapis/protoc-gen-openapiv2/options/annotations.proto, third_party/googleapis/protoc-gen-openapiv2/options/openapiv2.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-27T20:15:14.837362Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/sigstore/fulcio.svg",
  "full_name": "sigstore/fulcio",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}