wu / keyop-messenger

Full resolved dependency set from the GitHub dependency graph: 7 direct and 443 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 450 packages, which also include development and test pins that never ship: 4 carry known advisories, of which 1 are direct.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 1489,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 842727,
        "Shell": 871,
        "Makefile": 3311,
        "JavaScript": 4215
      },
      "pushed_at": "2026-07-21T05:42:01Z",
      "created_at": "2026-04-01T07:40:57Z",
      "owner_type": "User",
      "updated_at": "2026-07-21T05:42:12Z",
      "description": "Fast, lightweight, federated pub-sub messaging library for Go with at-least-once delivery guarantees, offline resilience, and mTLS security",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "BSD-2-Clause",
      "default_branch": "main",
      "license_spdx_raw": "BSD-2-Clause",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://blog.geekfarm.org/",
      "name": "Alex White",
      "type": "User",
      "login": "wu",
      "company": null,
      "location": null,
      "followers": 43,
      "avatar_url": "https://avatars.githubusercontent.com/u/52700?v=4",
      "created_at": "2009-02-08T03:28:54Z",
      "is_verified": null,
      "public_repos": 27,
      "account_age_days": 6376
    },
    "license": {
      "state": "standard",
      "spdx_id": "BSD-2-Clause",
      "raw_spdx": "BSD-2-Clause",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.24.3",
          "kind": "patch",
          "published_at": "2026-07-21T05:42:01Z"
        },
        {
          "tag": "v1.24.2",
          "kind": "patch",
          "published_at": "2026-07-21T02:36:39Z"
        },
        {
          "tag": "v1.24.1",
          "kind": "patch",
          "published_at": "2026-07-18T22:40:52Z"
        },
        {
          "tag": "v1.24.0",
          "kind": "minor",
          "published_at": "2026-07-02T16:50:07Z"
        },
        {
          "tag": "v1.23.0",
          "kind": "minor",
          "published_at": "2026-07-01T04:41:41Z"
        },
        {
          "tag": "v1.22.0",
          "kind": "minor",
          "published_at": "2026-06-26T16:26:59Z"
        },
        {
          "tag": "v1.21.0",
          "kind": "minor",
          "published_at": "2026-06-26T01:18:30Z"
        },
        {
          "tag": "v1.20.0",
          "kind": "minor",
          "published_at": "2026-06-26T00:40:10Z"
        },
        {
          "tag": "v1.19.0",
          "kind": "minor",
          "published_at": "2026-06-25T03:14:44Z"
        },
        {
          "tag": "v1.18.0",
          "kind": "minor",
          "published_at": "2026-06-25T00:07:03Z"
        },
        {
          "tag": "v1.17.0",
          "kind": "minor",
          "published_at": "2026-06-24T06:54:55Z"
        },
        {
          "tag": "v1.16.0",
          "kind": "minor",
          "published_at": "2026-06-23T20:24:25Z"
        },
        {
          "tag": "v1.15.1",
          "kind": "patch",
          "published_at": "2026-06-22T02:16:30Z"
        },
        {
          "tag": "v1.15.0",
          "kind": "minor",
          "published_at": "2026-06-22T00:53:40Z"
        },
        {
          "tag": "v1.14.0",
          "kind": "minor",
          "published_at": "2026-06-21T19:52:00Z"
        },
        {
          "tag": "v1.13.1",
          "kind": "patch",
          "published_at": "2026-06-19T18:28:04Z"
        },
        {
          "tag": "v1.13.0",
          "kind": "minor",
          "published_at": "2026-06-17T08:44:45Z"
        },
        {
          "tag": "v1.12.0",
          "kind": "minor",
          "published_at": "2026-06-16T00:32:44Z"
        },
        {
          "tag": "v1.11.1",
          "kind": "patch",
          "published_at": "2026-06-13T20:32:30Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2026-06-13T06:54:24Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2026-06-13T06:34:37Z"
        },
        {
          "tag": "v1.4.1",
          "kind": "patch",
          "published_at": "2026-06-12T05:19:54Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-06-12T04:48:37Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2026-05-17T00:48:54Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-05-13T22:44:47Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-04-29T02:01:11Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-04-28T20:07:15Z"
        },
        {
          "tag": "v0.14.1",
          "kind": "patch",
          "published_at": "2026-04-26T18:29:08Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-04-24T06:14:09Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-04-24T05:28:37Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-04-24T04:47:05Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-04-15T21:17:13Z"
        },
        {
          "tag": "v0.10.1",
          "kind": "patch",
          "published_at": "2026-04-13T07:59:17Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-04-13T03:43:55Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2026-04-13T02:43:25Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-04-11T17:44:16Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-04-11T04:14:23Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-04-11T03:07:50Z"
        },
        {
          "tag": "v0.6.2",
          "kind": "patch",
          "published_at": "2026-04-10T08:47:53Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2026-04-10T05:33:14Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "a62a9df6e3fad2cd11b5c5db209a18ce192f224d",
          "body": "## [1.24.3](https://github.com/wu/keyop-messenger/compare/v1.24.2...v1.24.3) (2026-07-21)\n\n### Bug Fixes\n\n* order latency Count updates after window/sum in dispatch ([ede427a](https://github.com/wu/keyop-messenger/commit/ede427a31843a35f682caf2c0fbc21c316e81e88))",
          "is_bot": true,
          "headline": "chore(release): 1.24.3 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-21T05:41:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ede427a31843a35f682caf2c0fbc21c316e81e88",
          "body": "Subscriber.dispatch() bumped the cumulative consumeAgeCount/\nhandlerLatencyCount atomics before recording the sample into the\nsliding-window histogram. Stats() reads Count and the histogram-derived\nWindowCount independently, so a snapshot taken in that gap could see\nCount reflect a sample the window\n[…]\ncaller) are fresh as well, not just WindowCount.\n\nSurfaced as a flaky TestStats_LatencyPercentilesAcrossSubscribers\nfailure on the armv6 CI runner, where the update gap is wide enough to\nhit reliably.",
          "is_bot": false,
          "headline": "fix: order latency Count updates after window/sum in dispatch",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T05:09:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "42c878fa368852c18b60f925eb2731cfad5b3597",
          "body": "…nable PR feedback\n\n- Added `pull_request` trigger to release workflow for PR-level test execution before merging.\n- Introduced `codeql-gate` job to block releases on open critical CodeQL alerts.\n- Updated `semantic-release` job dependencies to include `codeql-gate`.",
          "is_bot": false,
          "headline": "ci(release): extend release workflow to gate on CodeQL analysis and e…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T04:27:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "29671005117d071572e89fd9c8ffac285fd0fc54",
          "body": "Adds .github/workflows/codeql.yaml to run CodeQL static analysis on\npushes/PRs to main and weekly on a cron, so newly published CodeQL\nqueries and CVE signatures get applied even without a code change.",
          "is_bot": false,
          "headline": "ci(security): add CodeQL analysis workflow",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T03:16:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b0852f9fbbc50cf5c2d247bce776f15de170a23",
          "body": "…ckfill CHANGELOG\n\nRenovate PR #12 bumped conventional-changelog-conventionalcommits from\n9.3.1 to 10.2.0, reintroducing the exact writer-API mismatch that\nfc7d315 (2026-07-02) had already pinned around:\n@semantic-release/release-notes-generator@14 still bundles\nconventional-changelog-writer@8, but \n[…]\n be removed once release-notes-generator\n  ships a writer@9-compatible release.\n- CHANGELOG.md: backfill the Bug Fixes entries that v1.24.1 and\n  v1.24.2 published with empty sections due to this bug.",
          "is_bot": false,
          "headline": "ci(release): re-pin conventional-changelog-conventionalcommits and ba…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T03:03:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "323247f005e12a905ec76d96d02c94f4f07ab08b",
          "body": "## [1.24.2](https://github.com/wu/keyop-messenger/compare/v1.24.1...v1.24.2) (2026-07-21)",
          "is_bot": true,
          "headline": "chore(release): 1.24.2 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-21T02:36:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "261c3dfad69b7ff5255e01d4acde9b247d345af3",
          "body": "VerifyPeerCertificate does all peer identity verification here (CA-chain\ncheck plus CN-based auth), but resumed TLS sessions skip that callback\nentirely. Neither side of the federation config currently sets a\nClientSessionCache, so resumption isn't exercised today, but the\ntls.Config shape left the \n[…]\ndrops the now-redundant file-level //nolint:gosec comment (the\nper-line #nosec tags from the prior commit already cover it) and moves\nthe G402 justification onto its own line above InsecureSkipVerify.",
          "is_bot": false,
          "headline": "fix(tlsutil): disable TLS session resumption to close gosec G123 gap",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T02:35:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d6a9a72327c62f52d6e5dd3ec43997bf23a516b",
          "body": "… security scanning\n\n- Replaced all `//nolint:gosec` comments with `#nosec` tags for clearer integration with gosec.\n- Added `security` job in CI workflow to run `govulncheck` and `gosec` scanners.\n- Updated static analysis Makefile target to exclude generated files.\n- Enhanced Renovate config with custom version pinning for dependencies used in security checks.",
          "is_bot": false,
          "headline": "chore(security): replace nolint comments with #nosec tags and enhance…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T02:35:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a5fa3fffcc1b34261f8ef7537b4f81f1eb8bf74",
          "body": "Add `security` target to run static analysis tools (govulncheck, gosec) for detecting known vulnerabilities and security issues in the codebase.",
          "is_bot": false,
          "headline": "chore: add security analysis targets to Makefile",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-21T02:35:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c9c85adb841bb4b984b6cd3485b7637500aca9a",
          "body": "## [1.24.1](https://github.com/wu/keyop-messenger/compare/v1.24.0...v1.24.1) (2026-07-18)",
          "is_bot": true,
          "headline": "chore(release): 1.24.1 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-18T22:40:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa698fd17e0bb3aef1cd1883852c199a88d4ac9e",
          "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.81.1` → `v1.82.0` | ![age](https://\n[…]\nF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/7",
          "is_bot": false,
          "headline": "fix(deps): update module google.golang.org/grpc to v1.82.0 (#7)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T22:27:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92bd514dda8ce7bb73323fa8a4cee204a4f7e190",
          "body": "…mits to v10 (#12)\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [conventional-changelog-conventionalcommits](https://conventional-changelog.js.\n[…]\n0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/12",
          "is_bot": false,
          "headline": "chore(deps): update dependency conventional-changelog-conventionalcom…",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T21:24:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94168ed922e4bc6c6c21448f4cd472326f5452fd",
          "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>actions/checkout (actions/checkout)</summary>\n\n### [`v7.0.0`](https:/\n[…]\nF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/9",
          "is_bot": false,
          "headline": "chore(deps): update actions/checkout action to v7 (#9)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T21:24:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5bb40700c51ee092ac6c4ba8751e191cb97c167e",
          "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change | Pending |\n|---|---|---|---|---|\n| [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v5` → `v6` | `v7.0.0` (+1) |\n\n---\n\n### Release Notes\n\n<details>\n<summary>actions/setup-go (actions/setup-go)</su\n[…]\n0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/10",
          "is_bot": false,
          "headline": "chore(deps): update actions/setup-go action to v6 (#10)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T21:24:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "76f4e0d5bb76f9fbeb7bde43dad88f6a54eaec7e",
          "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/cache](https://github.com/actions/cache) | action | major | `v4` → `v6` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>actions/cache (actions/cache)</summary>\n\n### [`v6.1.0`](https://github.com/\n[…]\nF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/8",
          "is_bot": false,
          "headline": "chore(deps): update actions/cache action to v6 (#8)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T21:23:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "168c9b2f8e68738ba0ec80b72d9d3ee83f5f6fbc",
          "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change | Pending |\n|---|---|---|---|---|\n| [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v4` → `v6` | `v7.0.0` (+2) |\n\n---\n\n### Release Notes\n\n<details>\n<summary>actions/setup-node (actions/setup-n\n[…]\n0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/11",
          "is_bot": false,
          "headline": "chore(deps): update actions/setup-node action to v6 (#11)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T21:23:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a3e1ff267a265026d8b35fd34221c1ebb5395d9",
          "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| golang | container | minor | `1.25` → `1.26` |\n\n---\n\n### Configuration\n\n📅 **Schedule**: (UTC)\n\n- Branch creation\n  - At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule defined)\n\n\n[…]\nF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/4",
          "is_bot": false,
          "headline": "chore(deps): update golang docker tag to v1.26 (#4)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T20:50:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a3801ebe4627210498d7441ae9b6d4ffbc1ff58",
          "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [semantic-release](https://github.com/semantic-release/semantic-release) | [`25.0.5` → `25.0.8`](ht\n[…]\nF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/3",
          "is_bot": false,
          "headline": "chore(deps): update dependency semantic-release to v25.0.8 (#3)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T20:49:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e3edcb75e84a8117e3a4efe5dbddd982482b375",
          "body": null,
          "is_bot": false,
          "headline": "ci: customize renovate config",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-18T20:42:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b58ed1b5fc81b312f87ac35c8e48b8c299955748",
          "body": "Welcome to [Renovate](https://github.com/renovatebot/renovate)! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.\n\n🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.\n\n📚 See our [Readi\n[…]\nnfig-hash:e80b4e42a3043bc12fa0640db4bac392d2bf770acf841360d7c8ceeeac2ec1a9-->\n\nCo-authored-by: Renovate Bot <renovate-bot@geekfarm.org>\nReviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/2",
          "is_bot": false,
          "headline": "chore: Configure Renovate (#2)",
          "author_name": "renovate-bot",
          "author_login": null,
          "committed_at": "2026-07-18T20:00:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d87a012127a9f24a4086bc7579f86bb6dbfa7fd1",
          "body": "The dedup package exported a Deduplicator interface declaring only\nSeenOrAdd, which had no consumers and had drifted from the real\ncontract (SeenOrAdd + Remove). The interface federation actually uses\nis defined locally in internal/federation/peerreceiver.go. A note on\nLRUDedup now points readers to that convention so an exported\ninterface isn't reintroduced.",
          "is_bot": false,
          "headline": "chore: remove unused Deduplicator interface from internal/dedup",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-03T23:47:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "474b7e8316a271b9a731df507fd0c1e810bfe81f",
          "body": "Add missing CHANGELOG entries that weren't generated due to issues with\nsemantic release.",
          "is_bot": false,
          "headline": "chore: add missing CHANGELOG entries",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-03T03:22:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fc7d315b076f422f4a6c43ba374c6a9f781249d7",
          "body": "The release workflow installed semantic-release and its plugins with an\nunpinned `npm install --no-save`, so every run pulled whatever was latest.\nOn 2026-06-26 the conventional-changelog toolchain shipped coordinated\nmajors (conventionalcommits 9->10, writer 8->9, parser 6->7). preset v10\ntargets t\n[…]\ner 8.4.0 / parser 6.4.0 (no writer@9, parser@7, or\n  @conventional-changelog/template).\n- Replace `npm install --no-save ...` with `npm ci` and enable npm cache\n  in setup-node.\n- Ignore node_modules.",
          "is_bot": false,
          "headline": "ci(release): pin semantic-release toolchain to fix empty changelogs",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-03T03:21:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5e49221a36ed3a64a632b1aafc8e7053f4e1974",
          "body": "## [1.24.0](https://github.com/wu/keyop-messenger/compare/v1.23.0...v1.24.0) (2026-07-02)",
          "is_bot": true,
          "headline": "chore(release): 1.24.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-02T16:50:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52d6920b291a494def21e60019050794df1009fa",
          "body": "…ross restarts\n\nMaybeCompact computed its minimum \"safe to delete up to\" offset over only the\nsubscribers registered in this process's memory plus federation offset files\n(fed-*/fedout-*). Plain {subscriber-id}.offset files that exist on disk but\nwhose owner has not re-subscribed yet this process li\n[…]\n scan skip its result rather\nthan abort; the \".offset\" suffix check excludes in-flight \".offset.tmp\" files;\nand an empty offset dir still yields MaxInt64 (no consumers -> all sealed\nsegments deleted).",
          "is_bot": false,
          "headline": "fix(storage): honor persisted subscriber offsets during compaction ac…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-02T16:48:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "11c6c3672e428dffff1544c09b3044e177f6900a",
          "body": "Construct the example's logger with an explicit slog text handler writing to\nstdout instead of slog.Default(), and note why: without WithLogger(...) the\nmessenger falls back to a no-op logger that discards all output, including\ndead-letter and decode errors. The example now models the recommended setup.",
          "is_bot": false,
          "headline": "docs(example): use an explicit stdout logger in the example",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-02T16:48:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d71a784d5a046b419b48655bdd22d054ddaefb03",
          "body": "…a OnFatal\n\nAuto-reconnecting ephemeral clients previously looped forever on permanent\nfailures. Because the connection is established lazily and asynchronously, a\nhub rejecting the client — its certificate CN not in the allowlist\n(PermissionDenied) or an unauthenticated identity (Unauthenticated) —\n[…]\ned when AutoReconnect is enabled: NewEphemeralMessenger\n  returns an error otherwise, so this failure mode cannot be silently ignored.\n  The callback runs on a background goroutine and must not block.",
          "is_bot": false,
          "headline": "feat(ephemeral): stop reconnecting on non-retryable hub rejections vi…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-02T16:48:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f06e0f8fc22572241632b211cb8c30996989029b",
          "body": "## [1.23.0](https://github.com/wu/keyop-messenger/compare/v1.22.0...v1.23.0) (2026-07-01)",
          "is_bot": true,
          "headline": "chore(release): 1.23.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-01T04:41:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e40c2bd153402c3e479b847a4a38d094bb32eca",
          "body": "…elope\n\nLoop prevention previously relied solely on the in-memory LRU dedup cache,\nwhich is soft, size-bounded state. A node that both subscribes to and\npublishes to the same channel echoes received messages back to the hub;\ncorrectness depended on the hub still holding the message ID when the echo\n\n[…]\nor loops.\n\nBackward compatible: route is an additive, omitempty field, so no envelope\nversion bump. Pre-upgrade in-flight messages arrive with an empty Route and\nfall back to dedup until they age out.",
          "is_bot": false,
          "headline": "feat(federation): prevent routing loops with a path-vector on the env…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c60be30bb99aa2e1f0cb8519450397440af5b4ee",
          "body": "Add SendDurationMS (milliseconds, send_duration_ms) to audit.Event and\nset it on each outbound forward record, so the audit log captures how\nlong a message took to deliver. The value is the batch send→ack\nround-trip time already measured for RTT in clientCoordinator and\npubCoordinator; it is now also passed to auditOutboundForwards.\n\nAll envelopes in one batch share the batch's duration since they are\nsent and acked together.",
          "is_bot": false,
          "headline": "feat(audit): record send→ack duration on outbound forwards",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23f12fef8b4764a5eedef2dd1889b915a5e6bceb",
          "body": "The audit log previously recorded forward events only on the inbound\nside (peerreceiver.go, Direction: \"inbound\"). Add matching outbound\nforward logging at the two points where the local instance sends a batch\nand the remote peer acks it, so the audit log covers cross-hub\nforwarding in both directio\n[…]\neady uses as Peer).\n\nOutbound events are logged only after the peer acks, so they reflect\nconfirmed delivery and do not double-count with the inbound record,\nwhich is written in the receiving process.",
          "is_bot": false,
          "headline": "feat(audit): log outbound forwards in addition to inbound",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b28ab5dd445ed6c17da0d23f465b86f24534c2b",
          "body": "Bound channel disk usage by default. Previously force-eviction was driven by\na byte size cap (max_channel_size_mb) that defaulted to 0 (disabled), so a\nparked/disconnected subscriber or federation peer could pin a channel's log\ninto unbounded growth out of the box. Replace the byte cap with a cap on\n[…]\naced by storage.max_files. Disk-bounding is now on by default\n(10 log files per channel, including the active one); set max_files: 0 to\nrestore the previous unbounded, pure consumption-based behavior.",
          "is_bot": false,
          "headline": "feat(storage)!: replace max_channel_size_mb with max_files (default 10)",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5562415177d770fc1e8615d7aa0c36fbd9fb4be0",
          "body": "Clients build one outbound publish offset file per (hub, channel)\n(\"fedout-{hubAddr}.offset\") and never delete them on Close. When a hub is\nremoved from a client's configuration, that file remained on disk forever.\nBecause the compactor includes fedout- files in its minimum-offset boundary\n(fedMinOf\n[…]\n dialing clients, gated on DataDir,\n  building the hub set from cfg.Client.Hubs. Startup is the correct trigger\n  because clients are built at New(), so a config change only takes effect on\n  restart.",
          "is_bot": false,
          "headline": "fix(federation): reap orphaned fedout- offset files on startup",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "49f5d8fd7ab7c19ab6bada957e078f2ebf72f1d1",
          "body": "…blish\n\nThe configured MaxBatchBytes application limit was not enforced in two\npublish directions:\n\n- The hub's Publish handler called commitInboundBatch with maxBatchBytes=0,\n  so the per-record size check was disabled for client-to-hub ingest. Only\n  the coarser gRPC receive frame limit applied.\n-\n[…]\n. A deferred signal releases\n  a stranded pending item with ErrEphemeralConnLost on shutdown/connection\n  loss, matching the in-flight batch treatment. Marshaling factored into a\n  marshalItem helper.",
          "is_bot": false,
          "headline": "fix(federation): enforce MaxBatchBytes on hub ingest and ephemeral pu…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e9bd7c061c90cb7b92871b0ebf505baf2a22d96",
          "body": "AtomicPolicy.AllowForward was never invoked by the library — the real\nforward decision is made by effectiveSubscribeChannels, which correctly\ntreats an empty allowlist as \"permit any\". AllowForward instead returned\nfalse for an empty list, an internal contradiction that was masked only\nbecause the m\n[…]\n Drop the AllowForward tests; rewrite the atomic swap-race test to use\n  Receive/AllowReceive so concurrency coverage is preserved\n- Remove stray Forward field assignments in client/peerreceiver tests",
          "is_bot": false,
          "headline": "refactor(federation): remove dead AllowForward policy code",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-07-01T04:40:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9f5f94301e4bc9c644b4b3e6094e2ae7b0e2a8ea",
          "body": "## [1.22.0](https://github.com/wu/keyop-messenger/compare/v1.21.0...v1.22.0) (2026-06-26)\n\n### ⚠ BREAKING CHANGES\n\n* **registry:** An unregistered payload_type is no longer delivered to\nsubscribers as map[string]any. Durable subscribers dead-letter such messages;\nephemeral subscribers skip them with\n[…]\n69a40930190b6a97))\n* **storage:** roll back partial writes to prevent log corruption and message loss ([4ebbe9c](https://github.com/wu/keyop-messenger/commit/4ebbe9c0fae25d91bf01589b235650c3adf11224))",
          "is_bot": true,
          "headline": "chore(release): 1.22.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-26T16:26:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "48dd49562205c6d579481f55c2a30c543dce2c4e",
          "body": "…tter undecodable messages\n\nPreviously the registry coerced an unregistered payload_type into\nmap[string]any \"with a warning, never dropped\" (DESIGN.md). That fallback\nwas broken for non-object JSON: a published array, string, or number failed\nto unmarshal into a map, so Decode returned an error, th\n[…]\ns no longer delivered to\nsubscribers as map[string]any. Durable subscribers dead-letter such messages;\nephemeral subscribers skip them with a warning. registry.New() no longer takes\na logger argument.",
          "is_bot": false,
          "headline": "feat(registry)!: drop support for unregistered payload types; dead-le…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T16:25:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f98292aa130b0aef5b00c82269a40930190b6a97",
          "body": "…et paths\n\nCaller-controlled identifiers were joined directly into offset file paths\nwithout sanitization — an asymmetry with the outbound hub addresses, which\nwere already sanitized:\n\n- subscriber.go joined the public Subscribe subscriberID (never validated)\n  as filepath.Join(offsetDir, id+\".offse\n[…]\nby path, using the extracted\n  name only for logging.\n\nFor all normal IDs/CNs (already filename-safe) SanitizeForFilename is a\nno-op, so existing offset files are untouched; only unsafe inputs change.",
          "is_bot": false,
          "headline": "fix(storage,federation): sanitize subscriber IDs and peer CNs in offs…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T16:25:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d9fad8fa6b02c8ab0fa58d9555df73702f708e46",
          "body": "…rsal\n\nFederated inbound envelopes carry a potentially attacker-influenced Channel string\nthat flowed from commitInboundBatch / processBatchPerRecord into\nwriteLocalEnvelope / writeLocalEnvelopeBatch and then into\ngetOrCreateChannelState -> filepath.Join(dataDir, \"channels\", channel)\nwith no validat\n[…]\nngle choke point that every inbound\nfederation path (batch and per-record, hub and client receivers) funnels\nthrough before any filesystem access, so this one place covers all the\naffected call sites.",
          "is_bot": false,
          "headline": "fix(federation): validate inbound channel names to prevent path trave…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T16:25:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ebbe9c0fae25d91bf01589b235650c3adf11224",
          "body": "…message loss\n\nwriteRecord() ignored the byte count returned by f.Write(data). On a\ntransient error such as ENOSPC the OS may perform a partial write of\nn < len(data) bytes. Because segments are opened O_APPEND, the retry\nre-appended the full slice immediately after the partial bytes, producing\na co\n[…]\n  corrupt-segment fatal path. Verified all three fail against the un-fixed\n  code (invalid character '{' after object key) and pass with the fix.\n- Add Truncate to the remaining fileWriter test fakes.",
          "is_bot": false,
          "headline": "fix(storage): roll back partial writes to prevent log corruption and …",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T16:25:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f6cbf493acae92e986a777f271a640bfa28e86ba",
          "body": "## [1.21.0](https://github.com/wu/keyop-messenger/compare/v1.20.0...v1.21.0) (2026-06-26)\n\n### Features\n\n* add WindowCount to LatencyStage ([d6f7b7d](https://github.com/wu/keyop-messenger/commit/d6f7b7d4fee7e548fbd38ce7b1abba12eccec846))",
          "is_bot": true,
          "headline": "chore(release): 1.21.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-26T01:18:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6f7b7d4fee7e548fbd38ce7b1abba12eccec846",
          "body": "LatencyStage exposed Count (cumulative since start) alongside the p50/p90/p99\npercentiles (trailing ~60s window). A consumer pairing the two is misleading:\nthe percentiles describe a much smaller, recent population than the lifetime\nCount, so \"N samples → pXX\" did not line up.\n\nAdd WindowCount: the \n[…]\nhis is a small\nadditive field with no new bookkeeping. It applies to all five stages\n(PublishToDisk, Consume, Handler, and the federation PublishRTT/SubscribeRTT,\nwhich all flow through latencyStage).",
          "is_bot": false,
          "headline": "feat: add WindowCount to LatencyStage",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T01:17:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "11ad78c82d330be51415b3bae2c83a8eac6455c5",
          "body": "## [1.20.0](https://github.com/wu/keyop-messenger/compare/v1.19.0...v1.20.0) (2026-06-26)\n\n### Features\n\n* add federation client->hub ack-RTT latency ([3d0bb7e](https://github.com/wu/keyop-messenger/commit/3d0bb7eecb55417932112751f5a9a9a4d8ca9cd5))\n* add hub->peer subscribe-stream delivery RTT ([872\n[…]\n6a7bd425c4e03ace42))\n* **subscribers:** make the retry/backoff window configurable and per-subscriber ([876de80](https://github.com/wu/keyop-messenger/commit/876de80b448ec445fbdd29abcd5b6bdf70c82c0b))",
          "is_bot": true,
          "headline": "chore(release): 1.20.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-26T00:40:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ea5b49146ec59c9952431c9ff4f6a4f08628f6b0",
          "body": null,
          "is_bot": false,
          "headline": "chore: add loc target to Makefile for counting lines of code by category",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c3eff95a7a079fc48650af11c657df94ec9705e",
          "body": "LatencyStage previously exposed only a cumulative Count + SumNanos (a consumer\ndiffs them for a mean). Add P50Nanos/P90Nanos/P99Nanos: percentile estimates\nover a trailing ~60-second sliding window, computed server-side and\nself-contained (no diffing needed), so they reflect recent latency rather th\n[…]\nnally observes\ninto a Window. Consume/Handler are per-subscriber, so Stats() merges each\nsubscriber's window buckets before computing percentiles — averaging\nper-subscriber percentiles would be wrong.",
          "is_bot": false,
          "headline": "feat: add recent p50/p90/p99 latency percentiles to Stats",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "45ddd54c769e3fe17b05c16a7bd425c4e03ace42",
          "body": "The RTT aggregates record only successfully-acked batches, so a broken or\nstalled delivery contributes nothing to them. A high rate of those failures is\nitself an interesting signal, so add an error counter for each transit\ndirection:\n\n- Federation.Clients[].PublishSendFailures (outbound, per hub co\n[…]\nnectCount and the UnackedBytes backlog\ngauge. A failed batch is retried from the persisted offset after reconnect, so a\nsingle message can contribute one failure and, later, one successful RTT sample.",
          "is_bot": false,
          "headline": "feat: count federation batch send failures (both directions)",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "872276e7477f6b0e73a2d2e8be90473249a2b080",
          "body": "Adds the inbound half of federation transit latency: the round-trip from the hub\nsending a batch to a subscribing peer over the Subscribe stream to receiving that\npeer's ack. Reported hub-wide as Federation.Hub.SubscribeRTT (a LatencyStage:\nrunning Count + SumNanos).\n\nIt is measured in clientCoordin\n[…]\npeers, so\nit survives individual peer reconnects.\n\nAs with the outbound direction, this measures send->ack, which includes the\npeer's own write — transit plus remote durability, not pure network time.",
          "is_bot": false,
          "headline": "feat: add hub->peer subscribe-stream delivery RTT",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d0bb7eecb55417932112751f5a9a9a4d8ca9cd5",
          "body": "Adds the client->hub transit stage of the latency golden signal. Unlike the\nthree instance-wide stages in Stats.Latency, transit is reported per hub\nconnection as Federation.Clients[].PublishRTT (a LatencyStage: running Count +\nSumNanos).\n\nPublishRTT measures the round-trip from a federation client \n[…]\nasures send->ack, which includes the hub's own durable write — it is\ntransit plus remote durability, not pure network time. The regular Client is\ncovered; the ephemeral client is not yet instrumented.",
          "is_bot": false,
          "headline": "feat: add federation client->hub ack-RTT latency",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "217b28241f56265e2d683ddbb147c30678dc4869",
          "body": "Latency is the fourth golden signal and the one Stats() did not report. It is a\ndistribution, not a sum, so each stage exposes a running sample Count and\nSumNanos (summed nanoseconds); an exporter derives the mean over an interval as\nΔ(SumNanos)/Δ(Count), matching the count/sum style of Totals. The \n[…]\ned in dispatch on the success branch and\nexposed via ConsumeAgeAggregate/HandlerLatencyAggregate; Stats() sums the\nsubscriber aggregates across the channel loop and reads the write aggregate\ndirectly.",
          "is_bot": false,
          "headline": "feat: add per-stage latency aggregates to Stats",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f7f1559b3d7995499cae2818537479e424f68f4a",
          "body": "Stats() now reports instance-wide Totals alongside the per-channel slice, so\nmetrics exporters (Graphite, etc.) don't have to walk and sum the per-channel\nand per-subscriber data themselves. The aggregates cover three of the four\ngolden signals:\n\n- Traffic:    MessagesPublished, StreamBytes\n- Satura\n[…]\ntotal against the sum of the\nper-channel stats. Document the new totals in DESIGN.md S12 (Observability),\nnote that Latency is a planned signal (S12.3), and note the dead-letter write\ncounter in S5.5.",
          "is_bot": false,
          "headline": "feat: add pre-summed Totals to Stats for golden-signal metrics",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "876de80b448ec445fbdd29abcd5b6bdf70c82c0b",
          "body": "…-subscriber\n\nThe handler retry schedule (100ms base, doubling, 5s cap, 5 retries) was\nhardcoded, giving a fixed ~3.1s window before a failing message is\ndead-lettered. That rides out a brief blip but not a downstream restart or\nfailover (10-60s), and one global setting can't serve channels with dif\n[…]\no two subscribers on the SAME channel can\n  run different regimes — e.g. an ordered consumer with a wide window (or\n  ErrRetryLater) alongside a latency-sensitive consumer that dead-letters\n  quickly.",
          "is_bot": false,
          "headline": "feat(subscribers): make the retry/backoff window configurable and per…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-26T00:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4b7c9a376670943ad48522d1824851658eaefc9",
          "body": "## [1.19.0](https://github.com/wu/keyop-messenger/compare/v1.18.0...v1.19.0) (2026-06-25)\n\n### Features\n\n* **storage:** reserve dead-letter channels and bound their growth ([7e4d384](https://github.com/wu/keyop-messenger/commit/7e4d384798c07471edf592e9309349a2719d7043))\n\n### Bug Fixes\n\n* **federatio\n[…]\nmit/a30c3bd24e5b06cc1a08b27719a69a10739bbe77))\n* **storage:** drop advisory flock from the write path ([6f4fd10](https://github.com/wu/keyop-messenger/commit/6f4fd10e8d4cef7f785edb14f8055b3f52c13114))",
          "is_bot": true,
          "headline": "chore(release): 1.19.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-25T03:14:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7e4d384798c07471edf592e9309349a2719d7043",
          "body": "Dead-letter channels (\"{channel}.dead-letter\") were ordinary channels:\napplications could publish to them directly, and an undrained one grew\nwithout bound because consumption-based compaction never reclaims segments\nno subscriber has read. Three changes make them safe by default.\n\nReserved suffix:\n\n[…]\n\n  regular channels) — so a quiet dead-letter channel seals its active\n  segment sooner so the 7-day retention is more likely to reclaim it instead\n  of holding everything in one never-rolled segment.",
          "is_bot": false,
          "headline": "feat(storage): reserve dead-letter channels and bound their growth",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-25T03:12:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e68ff4f589c14ed4a444da7b7c1ab27502560c49",
          "body": "…rrency\n\nTestStats_HubRejectsUnknownPeer intermittently panicked with \"close of\nclosed channel\" on arm6 (and was a latent race everywhere else).\n\nClient.Close() both closes c.stop and cancels the gRPC stream context.\nCancelling the stream fires coord.Done(), so the reconnect goroutine —\nparked on `s\n[…]\ners until f returns, every caller still blocks until the\ngoroutine has exited, preserving the \"close waits for exit\" contract.\nclientCoordinator is only closed once today but is fixed for consistency.",
          "is_bot": false,
          "headline": "fix(federation): make coordinator/reader close idempotent under concu…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-25T03:12:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6f4fd10e8d4cef7f785edb14f8055b3f52c13114",
          "body": "The writer took an advisory flock around any record larger than PIPE_BUF\n(4 KiB) to guarantee append atomicity. That only ever protected against\n*concurrent writers in another process* — within a process every append\nto a channel is already serialized through the single per-channel writer\ngoroutine,\n[…]\n.2: remove the PIPE_BUF/flock description from both the\n  single-write and batched-write paragraphs; explain that single-process\n  ownership plus the single writer goroutine makes locking unnecessary.",
          "is_bot": false,
          "headline": "refactor(storage): drop advisory flock from the write path",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-25T03:12:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a30c3bd24e5b06cc1a08b27719a69a10739bbe77",
          "body": "The fsnotify-backed ChannelWatcher was fully implemented and tested but\nnever instantiated in production code — the Messenger wires subscribers\nexclusively to the in-process LocalNotifier, backstopped by a 1-second\nsafety poll. Each data_dir is owned by a single process, so cross-process\nfilesystem \n[…]\ncation around the in-process\n  LocalNotifier and 1-second safety poll; remove the fsnotify/polling/\n  path-normalisation description.\n- DESIGN.md §9.1/§9.2: fix write/read-path references to fsnotify.",
          "is_bot": false,
          "headline": "refactor: remove unused fsnotify watcher and update design doc",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-25T03:12:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1ef39bfabb6fd6e0e5e4fa1d7965b637a2fffe55",
          "body": "## [1.18.0](https://github.com/wu/keyop-messenger/compare/v1.17.0...v1.18.0) (2026-06-25)\n\n### Features\n\n* **stats:** expose dropped/paused counters and oldest-pending latency ([d09c769](https://github.com/wu/keyop-messenger/commit/d09c76940e656fbdae8ad44e0f852a1e13b46469))",
          "is_bot": true,
          "headline": "chore(release): 1.18.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-25T00:06:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d09c76940e656fbdae8ad44e0f852a1e13b46469",
          "body": "Two additions to observability, both surfacing data the storage layer already\ntracked but the public API hid.\n\nDiagnosticStats — pass through three per-subscriber counters from the storage\nsubscriber's Stats() that DiagnosticStats was dropping: CompactionDrops\n(messages permanently removed by retent\n[…]\n subscriber is behind and\nleaves it 0 when caught up. The value is Unix-ms so callers compute age at\ndisplay time, avoiding baked-in clock skew. Best-effort: read errors are logged\nand fall back to 0.",
          "is_bot": false,
          "headline": "feat(stats): expose dropped/paused counters and oldest-pending latency",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-25T00:05:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ce076d548ca64c8580e8339c9a4acf22041629c",
          "body": "## [1.17.0](https://github.com/wu/keyop-messenger/compare/v1.16.0...v1.17.0) (2026-06-24)\n\n### Features\n\n* **federation:** add inbound hub-side metrics to Stats() ([7bea19f](https://github.com/wu/keyop-messenger/commit/7bea19fb89c3b93e60068ae5604ec5cd4c552e97))\n* **federation:** declare client publish channels to the hub ([8440e40](https://github.com/wu/keyop-messenger/commit/8440e407d0b0dcbce5f58a99d2c9a33d50606bcc))",
          "is_bot": true,
          "headline": "chore(release): 1.17.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-24T06:54:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7bea19fb89c3b93e60068ae5604ec5cd4c552e97",
          "body": "Surface hub-side observability through Messenger.Stats(). Previously\nStats().Federation only reported outbound client connections; a hub\ninstance had no visibility into the peers connecting to it.\n\nThe hub now tracks active inbound streams and cumulative counters:\n\n- per-peer connection registry (pe\n[…]\nels the client\ndeclared via the x-federation-publish-channels metadata header (falling\nback to the configured allowlist when undeclared), so the reported set\nreflects what the peer actually publishes.",
          "is_bot": false,
          "headline": "feat(federation): add inbound hub-side metrics to Stats()",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-24T06:26:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8440e407d0b0dcbce5f58a99d2c9a33d50606bcc",
          "body": "Federation clients now advertise the channels they publish via a new\n`x-federation-publish-channels` gRPC metadata header on the Publish\nstream, populated from the client's configured `publish` list. The hub\nreads the declaration and reports it in the `client_connected` audit\ndetail, falling back to\n[…]\nub has the header ignored, and an old client\nagainst a new hub falls back to the allowlist for reporting.\n\nThis lays the groundwork for hub-side stats to report the channels a\npeer actually publishes.",
          "is_bot": false,
          "headline": "feat(federation): declare client publish channels to the hub",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-24T06:21:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fddea474027044aaee0abae28b80a0a99faa7f45",
          "body": null,
          "is_bot": false,
          "headline": "chore: update Go setup action to v5 and use go.mod for version",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-23T20:28:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8084cffb5d7a16e39aa0c9d08884044d4a3540d",
          "body": "## [1.16.0](https://github.com/wu/keyop-messenger/compare/v1.15.1...v1.16.0) (2026-06-23)\n\n### Features\n\n* **federation:** batch hub ingest and unify the inbound commit path ([85d280e](https://github.com/wu/keyop-messenger/commit/85d280e4b081875261521dc719c5fefeb61fbd32))\n* **federation:** batch rec\n[…]\ncf374972e85b86fbc2202756125cd5e7bc97c8))\n* **storage:** add WriteBatch for single-fsync batch appends ([cc0b18f](https://github.com/wu/keyop-messenger/commit/cc0b18f17d13587c6e431e0bb68b2ac0519319e3))",
          "is_bot": true,
          "headline": "chore(release): 1.16.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-23T20:24:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "51fd829c268ff5109380a48424ef54309b45abbc",
          "body": "Raise total coverage from 84.1% to 85.0% (CI gate is 84.0%), restoring\nmargin above the threshold enforced in .forgejo/workflows/build.yaml.\n\nAdds focused tests for the highest-value hand-written functions that had\nzero or partial coverage:\n\n- tlsutil.ExtractLocalCN: success path plus all four error\n[…]\nry: table test across all four branches (future days,\n  within a day, expired days, expired within a day).\n- cmd extKeyUsageLabel: all named EKUs plus a niche EKU exercising the\n  eku(N) default case.",
          "is_bot": false,
          "headline": "test: add coverage for untested pure-logic helpers",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-23T20:23:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "85d280e4b081875261521dc719c5fefeb61fbd32",
          "body": "Convert the hub's Publish handler (client->hub) to commit each inbound batch\nwith a single WriteBatch (one fsync) before acking, matching the durable\nclient receiver, and factor the shared logic out so both paths use one\nimplementation.\n\n- Add commitInboundBatch, used by both the hub Publish handler\n[…]\nh-1 round trip keeps batches at size 1 and cannot). An A/B against\na per-record hub showed SyncImmediate ~5.55ms/op -> ~4.24ms/op. The shared\nfederation bench setup is factored into newFederationPair.",
          "is_bot": false,
          "headline": "feat(federation): batch hub ingest and unify the inbound commit path",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-23T20:23:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59f9e4dc41b5eb1d6f7504adfa16d10def413163",
          "body": "…mmit\n\nPeerReceiver now commits all accepted records of an inbound batch in a single\nWriteBatch (one fsync) before acking, amortising the per-record fsync on the\nhub->client ingest path used by durable clients.\n\nThe ack is kept strictly behind the commit so at-least-once holds without loss:\n\n- Dedup\n[…]\ned) and the original per-record path. Ephemeral clients, which dispatch\n  to in-memory handlers rather than a durable store, keep the per-record path\n  (nil batch writer) and their existing semantics.",
          "is_bot": false,
          "headline": "feat(federation): batch receive-side commits with strict ack-after-co…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-23T20:23:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aacf374972e85b86fbc2202756125cd5e7bc97c8",
          "body": "PublishBatch(ctx, channel, msgs) publishes multiple messages to one channel\nas a single durable unit. Each msg is a BatchMessage carrying its own payload\ntype, so a single batch may mix event types on a channel; the channel and the\ncontext's correlation ID and service name are shared. It builds one \n[…]\n prefix that reached disk,\nconsistent with at-least-once). Message order is preserved and an empty batch\nis a no-op. One notification per batch wakes local subscribers and outbound\nfederation readers.",
          "is_bot": false,
          "headline": "feat(messenger): add PublishBatch built on WriteBatch",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-23T20:23:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cc0b18f17d13587c6e431e0bb68b2ac0519319e3",
          "body": "Add WriteBatch to the ChannelWriter, which appends multiple records as a\nsingle durable unit: each record is written in order through the existing\nper-record path, but one fsync and one subscriber notification cover the\nwhole batch when sync_interval_ms=0. This amortises the per-record fsync —\nthe d\n[…]\nrite behaviour is unchanged. Add WriteBatch to FakeChannelWriter.\n\nThis is the storage-layer primitive; higher-level batched publish and\nbatched federation ingest will build on it (not wired up here).",
          "is_bot": false,
          "headline": "feat(storage): add WriteBatch for single-fsync batch appends",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-23T20:23:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4795bb672fab768a0257d728d0c29084271daefa",
          "body": "## [1.15.1](https://github.com/wu/keyop-messenger/compare/v1.15.0...v1.15.1) (2026-06-22)\n\n### Bug Fixes\n\n* skip records larger than maxLineSize instead of wedging the subscriber ([3a5d83f](https://github.com/wu/keyop-messenger/commit/3a5d83f30ed474b258af33c4f5af46552e4c0858))",
          "is_bot": true,
          "headline": "chore(release): 1.15.1 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-22T02:16:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a5d83f30ed474b258af33c4f5af46552e4c0858",
          "body": "…criber\n\nA single record exceeding the 10 MiB scanner buffer (e.g. an RSS image\nevent whose base64 payload tops 10 MiB) caused bufio.Scanner to return\nErrTooLong without yielding the record. The subscriber never advanced its\noffset and froze on that record, buffering every newer message behind it\nin\n[…]\nl buffer size are now package vars\n(unchanged in production) so the regression test can shrink them and\nexercise the skip path with a few-KiB record instead of writing a real\n10 MiB file on every run.",
          "is_bot": false,
          "headline": "fix: skip records larger than maxLineSize instead of wedging the subs…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-22T02:15:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "923055b36477271993cacd52f3e4cf2b402306aa",
          "body": "## [1.15.0](https://github.com/wu/keyop-messenger/compare/v1.14.0...v1.15.0) (2026-06-22)\n\n### Features\n\n* add per-subscription startup max-age; remove max_subscriber_lag_mb ([6f5258a](https://github.com/wu/keyop-messenger/commit/6f5258aec2649e2e09cc33493feab050ac4a4ec9))\n* bound channel disk usage with size and age retention ([f1d0866](https://github.com/wu/keyop-messenger/commit/f1d086676e0a4aedd79f9bbc6bfef4a521f8703e))",
          "is_bot": true,
          "headline": "chore(release): 1.15.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-22T00:53:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f5258aec2649e2e09cc33493feab050ac4a4ec9",
          "body": "Replace the warning-only subscriber-lag knob with a useful per-consumer\nfreshness control, and drop the lag warning entirely.\n\nStartup max-age filtering\n-------------------------\nA subscription can now declare a maximum message age via a new SubscribeOption:\n\n    m.Subscribe(ctx, channel, id, handle\n[…]\n\n    MaybeCompact.\n\nThe per-subscriber SubscriberStats.LagBytes metric (observability) is retained.\nOld config files containing max_subscriber_lag_mb still load — the key is now\nignored, not rejected.",
          "is_bot": false,
          "headline": "feat: add per-subscription startup max-age; remove max_subscriber_lag_mb",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-22T00:52:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f1d086676e0a4aedd79f9bbc6bfef4a521f8703e",
          "body": "Add optional per-channel retention so a parked or lagging subscriber can no\nlonger pin a channel's log into unbounded growth and fill the filesystem.\nPreviously the compactor only deleted segments fully consumed by every\nsubscriber (and federation peer); one slow consumer prevented all reclamation,\n\n[…]\niber fast-forward past compacted data, and day-unit duration parsing.\n\nThe public API change (storage.NewCompactor signature) is internal; the two new\nYAML fields are additive and backward compatible.",
          "is_bot": false,
          "headline": "feat: bound channel disk usage with size and age retention",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-22T00:52:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "44b95fb98f62a591bc2d145ffbd016b39a0b5828",
          "body": "## [1.14.0](https://github.com/wu/keyop-messenger/compare/v1.13.1...v1.14.0) (2026-06-21)\n\n### Features\n\n* add ErrRetryLater for transient handler failures ([8ece79b](https://github.com/wu/keyop-messenger/commit/8ece79b1b519fdcf8dc82a08ac92736c9365cddc))",
          "is_bot": true,
          "headline": "chore(release): 1.14.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-21T19:51:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8ece79b1b519fdcf8dc82a08ac92736c9365cddc",
          "body": "Introduce a sentinel error that lets a subscriber signal a transient\ndownstream failure (e.g. a metrics sink is unreachable) without\nlosing the message. When a handler returns ErrRetryLater (directly or\nwrapped), the subscriber:\n\n  - does NOT advance its offset\n  - does NOT count the attempt against\n[…]\nmes verifying the\n    offset is parked, nothing is dead-lettered, and delivery resumes after\n    the handler stops signalling ErrRetryLater.\n\nThe public API change is additive and backward compatible.",
          "is_bot": false,
          "headline": "feat: add ErrRetryLater for transient handler failures",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-21T19:50:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a65eb51782569f12662b6d587a1f2781b651cc41",
          "body": "## [1.13.1](https://github.com/wu/keyop-messenger/compare/v1.13.0...v1.13.1) (2026-06-19)\n\n### Bug Fixes\n\n* **federation:** raise gRPC frame limit and skip undeliverable records ([4394443](https://github.com/wu/keyop-messenger/commit/4394443ceb4f85606a9ea808c8cbeae2455e0d3b))\n* **messenger:** release audit writer when New fails after start ([224e077](https://github.com/wu/keyop-messenger/commit/224e077ce3ad59f749fc4cf5b7c0cb3f9a9594a8))",
          "is_bot": true,
          "headline": "chore(release): 1.13.1 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-19T18:28:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5961229bd655c4ed9afb8815a808fd9ae215a564",
          "body": "Add unit tests for logic that the default coverage run reported as\nuncovered. These functions were genuinely untested (not just gated\nbehind the integration build tag).\n\n- internal/federation/policy_internal_test.go: cover the unexported\n  channel-allowlist helpers that implement the \"subscribe ∩ al\n[…]\nve-copy\n  guarantee and order/duplicate preservation. 0-50% -> 100%.\n\n- messenger_diagnostics_test.go: cover DiagnosticStats for the unknown\n  channel, unknown subscriber, and happy paths. 0% -> 100%.",
          "is_bot": false,
          "headline": "test: cover federation channel policy and DiagnosticStats",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc2c798f4b27413cf40f05eaaaa50b50df98eecc",
          "body": "… to 5m\n\nThe coverage CI job now delegates to `make coverage` instead of its own\n`go test -coverpkg=./...` invocation, so CI and a local `make coverage`\ncompute the number identically: `go test -race -tags integration` over the\npackage list excluding the `example`, `internal/testutil`, and `gen`\npackages.  The threshold step parses the total from the captured output.\n`make` is added to the job's apt-get install.\n\nStandardize every `go test` timeout to 5m.",
          "is_bot": false,
          "headline": "ci: align coverage job with `make coverage` and set all test timeouts…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a771150c61885e0dcd97f6038f0bfbb3ffdb5631",
          "body": "Ensure the coverage doesn't drop.",
          "is_bot": false,
          "headline": "ci: add coverage status check in forgejo",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "224e077ce3ad59f749fc4cf5b7c0cb3f9a9594a8",
          "body": "New starts the audit writer (and its background goroutine) before it\nvalidates that federation requires TLS, builds the TLS config, derives the\ninstance identity, and starts the hub/clients. Every error return after the\nwriter is created left that goroutine running. A leaked writer keeps\ncreating fi\n[…]\nel and waits for the goroutine\nto exit, so the data dir is quiescent by the time New returns. Also close\nthe client on the connect-to-hub error path, which leaked its reconnect\ngoroutine the same way.",
          "is_bot": false,
          "headline": "fix(messenger): release audit writer when New fails after start",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "062ea5744972690934e938e3dc4fe6ee62d01b8d",
          "body": "…ivery",
          "is_bot": false,
          "headline": "test: improve lag bytes assertion in stats_test.go for subscriber del…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "010da20331fc8b1f477d4158e893d5194cafb65f",
          "body": "…ests",
          "is_bot": false,
          "headline": "test: resolve test lint issues and include integration tags on lint t…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4394443ceb4f85606a9ea808c8cbeae2455e0d3b",
          "body": "The hub and client used gRPC's default 4 MiB receive limit while large\npayloads (e.g. rendered HTML on browser-requests) routinely exceeded it.\nA peer publishing such a record got ResourceExhausted on the Publish\nstream, which tore down the coordinator and triggered a reconnect. Because\nthe record's\n[…]\ned at\n   the frame limit so it is never over-allocated.\n\nSize limits are var (not const) only so tests can shrink them and exercise\nthese paths with kilobyte payloads; production never reassigns them.",
          "is_bot": false,
          "headline": "fix(federation): raise gRPC frame limit and skip undeliverable records",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-19T18:26:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "63e2b5da3be8924e8514dbe4a39acbe4c747406d",
          "body": "## [1.13.0](https://github.com/wu/keyop-messenger/compare/v1.12.0...v1.13.0) (2026-06-17)\n\n### Features\n\n* add diagnostic counters and stats for subscriber and notifier ([02d40d8](https://github.com/wu/keyop-messenger/commit/02d40d8634e0f0971735a6fd7196c0835e1aba7d))\n* add periodic polling to preven\n[…]\nb98251b17677f857))\n\n### Refactoring\n\n* consolidate test steps and extend timeout for throughput tests ([a6ca2a9](https://github.com/wu/keyop-messenger/commit/a6ca2a9d1b8678b354d451f98c4c4778a5de3a37))",
          "is_bot": true,
          "headline": "chore(release): 1.13.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-17T08:44:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9964682d942772d0306e745959876519e93a40b",
          "body": "The subscriber's processAvailable used a bufio.Scanner with the default\nScanLines SplitFunc to walk segment files. ScanLines has a feature that's\nappropriate for text-file consumers but wrong for a streaming append-only\nlog: when it hits EOF with buffered bytes that lack a terminating '\\n',\nit emits\n[…]\nnotify re-runs\nprocessAvailable, which re-reads from the same offset and now sees the\nfully-terminated line. No record is ever consumed before its '\\n'\narrives, so no record is ever lost to this race.",
          "is_bot": false,
          "headline": "fix: do not emit partial trailing lines from subscriber scanner",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T08:36:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d40902c90efa681b3ecbe51bb98251b17677f857",
          "body": "If keyop-messenger's process crashes mid-write (OOM, kill -9, panic, power\nloss), the active segment file is left with non-newline-terminated bytes at\nits tail — bytes that were copied into the page cache but never made it to a\ncomplete record. The file invariant the JSONL format depends on (every b\n[…]\nal victim.\n\nPaired with the subscriber-side scanCompleteLines change (cc1bdc7), this\ncovers both the live-race case (subscriber reads concurrently with a slow\nwriter) and the post-crash recovery case.",
          "is_bot": false,
          "headline": "fix: truncate partial trailing bytes on writer startup",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T08:36:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "02d40d8634e0f0971735a6fd7196c0835e1aba7d",
          "body": null,
          "is_bot": false,
          "headline": "feat: add diagnostic counters and stats for subscriber and notifier",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T07:44:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21fa3a5e80fb450f629d2f03d7d9324da5310ab5",
          "body": null,
          "is_bot": false,
          "headline": "feat: add periodic polling to prevent lost-wakeup races in subscriber",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T07:26:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a6ca2a9d1b8678b354d451f98c4c4778a5de3a37",
          "body": null,
          "is_bot": false,
          "headline": "refactor: consolidate test steps and extend timeout for throughput tests",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T06:42:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0af5d81f5997cd8cd3eb9a46aedabd4dbf6838ff",
          "body": null,
          "is_bot": false,
          "headline": "feat: increase timeout for tests on raspi (armv6 and arm64)",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T06:28:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8bc0682e8edb3a980fa481aa9117f25cb4e494ed",
          "body": null,
          "is_bot": false,
          "headline": "feat: enhance CI configuration for multi-architecture  tests",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-17T06:19:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a4f5e5bbb1920579ad22cd64a72d99979ad11373",
          "body": null,
          "is_bot": false,
          "headline": "chore: remove .idea folder",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-16T23:56:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2f64f211cb844c01ad4e693c0a7c37c9780a886a",
          "body": null,
          "is_bot": false,
          "headline": "chore: add .claude to .gitignore",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-16T22:42:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8788953e09aa38a9e3bda8b73d6f6f3721c48ef3",
          "body": "## [1.12.0](https://github.com/wu/keyop-messenger/compare/v1.11.1...v1.12.0) (2026-06-16)\n\n### Features\n\n* add 'inspect' command to keygen for detailed certificate information ([86f4e20](https://github.com/wu/keyop-messenger/commit/86f4e207ab4dc02721107a66a6e577e61f8f0f85))\n* add Forgejo Actions workflow for private dev ([#1](https://github.com/wu/keyop-messenger/issues/1)) ([31fa405](https://github.com/wu/keyop-messenger/commit/31fa405d65461b524cee7ca9851e34def93304a4))",
          "is_bot": true,
          "headline": "chore(release): 1.12.0 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-16T00:32:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c213d47c2c1a0b86f990a992ddc068234c91b2f4",
          "body": "The cert is now the only identity used for federation.",
          "is_bot": false,
          "headline": "docs: update example configuration to use instance-specific certs",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-15T19:09:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "31fa405d65461b524cee7ca9851e34def93304a4",
          "body": "Reviewed-on: https://git.geekfarm.org/wu/keyop-messenger/pulls/1",
          "is_bot": false,
          "headline": "feat: add Forgejo Actions workflow for private dev (#1)",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-15T19:06:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "86f4e207ab4dc02721107a66a6e577e61f8f0f85",
          "body": "…ation",
          "is_bot": false,
          "headline": "feat: add 'inspect' command to keygen for detailed certificate inform…",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-14T03:39:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "41d4f31a5ace7abc088c2ee81ac984313a5e0fd6",
          "body": null,
          "is_bot": false,
          "headline": "ci: sync dependencies across keyop projects",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-14T03:28:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b1968530600bdb1509d6c8177a3f811cf72f49a4",
          "body": "## [1.11.1](https://github.com/wu/keyop-messenger/compare/v1.11.0...v1.11.1) (2026-06-13)\n\n### Bug Fixes\n\n* **release:** renumber v2/v3/v4 changelog entries into v1 lineage ([48a5563](https://github.com/wu/keyop-messenger/commit/48a556340444737ef86b790658eaa6397ac6d210))",
          "is_bot": true,
          "headline": "chore(release): 1.11.1 [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-13T20:32:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48a556340444737ef86b790658eaa6397ac6d210",
          "body": "Following the decision to disable major version bumps (see\nrelease.config.mjs), the existing v2.0.0–v4.2.0 release tags were\nrenamed to v1.7.0–v1.11.0. This commit updates CHANGELOG.md to match\nthe renamed tags. Each affected section's heading and compare-URL\nendpoints are remapped:\n\n    v2.0.0  → v\n[…]\n.0.1  → v1.8.1\n    v4.0.0  → v1.9.0\n    v4.1.0  → v1.10.0\n    v4.2.0  → v1.11.0\n\nCommit SHAs, dates, and BREAKING CHANGES notes are preserved for the\nhistorical record; only the version labels change.",
          "is_bot": false,
          "headline": "fix(release): renumber v2/v3/v4 changelog entries into v1 lineage",
          "author_name": "Alex White",
          "author_login": "wu",
          "committed_at": "2026-06-13T20:31:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 40,
      "commits_last_year": 239,
      "latest_release_at": "2026-07-21T05:42:01Z",
      "latest_release_tag": "v1.24.3",
      "releases_from_tags": false,
      "days_since_last_push": 3,
      "active_weeks_last_year": 12,
      "days_since_latest_release": 3,
      "mean_days_between_releases": 2.9
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/wu/keyop-messenger",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/wu/keyop-messenger",
          "is_deprecated": false,
          "latest_version": "v1.24.3",
          "repository_url": "https://github.com/wu/keyop-messenger",
          "versions_count": 52,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-21T05:41:58Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 3
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [
        "proto/federation/v1/federation.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 43904,
      "source_files_sampled": 102,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 4483
    },
    "dependencies": {
      "manifests": [
        "go.mod",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 3
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "5.0.7",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh99-v99m-4gvg"
            ],
            "fixed_version": "5.0.8",
            "advisory_count": 1,
            "oldest_advisory_days": 0
          },
          {
            "name": "tar",
            "direct": false,
            "version": "7.5.19",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-r292-9mhp-454m"
            ],
            "fixed_version": "7.5.21",
            "advisory_count": 1,
            "oldest_advisory_days": 0
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 1,
          "unknown": 1,
          "critical": 1,
          "moderate": 1
        },
        "advisory_count": 4,
        "affected_count": 4,
        "assessed_count": 450,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/hashicorp/golang-lru/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.7"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.0"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.11"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": true,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260610212136-7ab31c22f7ad",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/check.v1",
            "direct": false,
            "version": "v1.0.0-20201130134442-10cb98267c6c",
            "ecosystem": "go"
          },
          {
            "name": "@actions/core",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@actions/exec",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@actions/http-client",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@actions/io",
            "direct": false,
            "version": "3.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/code-frame",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-identifier",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@colors/colors",
            "direct": false,
            "version": "1.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "@gar/promise-retry",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@isaacs/fs-minipass",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@isaacs/string-locale-compare",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/agent",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/arborist",
            "direct": false,
            "version": "9.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/config",
            "direct": false,
            "version": "10.12.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/fs",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/git",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/installed-package-contents",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/map-workspaces",
            "direct": false,
            "version": "5.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/metavuln-calculator",
            "direct": false,
            "version": "9.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/name-from-folder",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/node-gyp",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/package-json",
            "direct": false,
            "version": "7.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/promise-spawn",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/query",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/redact",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@npmcli/run-script",
            "direct": false,
            "version": "10.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/auth-token",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/core",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/endpoint",
            "direct": false,
            "version": "11.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/graphql",
            "direct": false,
            "version": "9.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/openapi-types",
            "direct": false,
            "version": "27.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/plugin-paginate-rest",
            "direct": false,
            "version": "14.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/plugin-retry",
            "direct": false,
            "version": "8.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/plugin-throttling",
            "direct": false,
            "version": "11.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/request",
            "direct": false,
            "version": "10.0.11",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/request-error",
            "direct": false,
            "version": "7.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@octokit/types",
            "direct": false,
            "version": "16.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@pnpm/config.env-replace",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@pnpm/network.ca-file",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@pnpm/npm-conf",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@sec-ant/readable-stream",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/changelog",
            "direct": false,
            "version": "6.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/commit-analyzer",
            "direct": false,
            "version": "13.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/error",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/error",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/git",
            "direct": false,
            "version": "10.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/github",
            "direct": false,
            "version": "12.0.9",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/npm",
            "direct": false,
            "version": "13.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@semantic-release/release-notes-generator",
            "direct": false,
            "version": "14.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@sigstore/bundle",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@sigstore/core",
            "direct": false,
            "version": "3.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "@sigstore/protobuf-specs",
            "direct": false,
            "version": "0.5.1",
            "ecosystem": "npm"
          },
          {
            "name": "@sigstore/sign",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@sigstore/tuf",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@sigstore/verify",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@simple-libs/stream-utils",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "@sindresorhus/is",
            "direct": false,
            "version": "4.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "@sindresorhus/merge-streams",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@tufjs/canonical-json",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@tufjs/models",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/normalize-package-data",
            "direct": false,
            "version": "2.4.4",
            "ecosystem": "npm"
          },
          {
            "name": "abbrev",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "agent-base",
            "direct": false,
            "version": "7.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "agent-base",
            "direct": false,
            "version": "9.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "aggregate-error",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "aggregate-error",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-escapes",
            "direct": false,
            "version": "7.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-regex",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-regex",
            "direct": false,
            "version": "6.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "3.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "6.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "any-promise",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "aproba",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "archy",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "argparse",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "argv-formatter",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "array-ify",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "balanced-match",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "before-after-hook",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "bin-links",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "binary-extensions",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "bottleneck",
            "direct": false,
            "version": "2.19.5",
            "ecosystem": "npm"
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "5.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "braces",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "cacache",
            "direct": false,
            "version": "20.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "callsites",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "2.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "5.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "char-regex",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "chownr",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "ci-info",
            "direct": false,
            "version": "4.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "cidr-regex",
            "direct": false,
            "version": "5.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "clean-stack",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "clean-stack",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "cli-highlight",
            "direct": false,
            "version": "2.1.11",
            "ecosystem": "npm"
          },
          {
            "name": "cli-table3",
            "direct": false,
            "version": "0.6.5",
            "ecosystem": "npm"
          },
          {
            "name": "cliui",
            "direct": false,
            "version": "7.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "cliui",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "cmd-shim",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "color-convert",
            "direct": false,
            "version": "1.9.3",
            "ecosystem": "npm"
          },
          {
            "name": "color-convert",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "color-name",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "color-name",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "common-ancestor-path",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "compare-func",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "config-chain",
            "direct": false,
            "version": "1.1.13",
            "ecosystem": "npm"
          },
          {
            "name": "content-type",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "conventional-changelog-angular",
            "direct": false,
            "version": "8.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "conventional-changelog-conventionalcommits",
            "direct": false,
            "version": "9.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "conventional-changelog-writer",
            "direct": false,
            "version": "8.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "conventional-commits-filter",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "conventional-commits-parser",
            "direct": false,
            "version": "6.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "convert-hrtime",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "core-util-is",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "cosmiconfig",
            "direct": false,
            "version": "9.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "crypto-random-string",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "cssesc",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "deep-extend",
            "direct": false,
            "version": "0.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "diff",
            "direct": false,
            "version": "8.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "dir-glob",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "dot-prop",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "duplexer2",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "emoji-regex",
            "direct": false,
            "version": "10.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "emoji-regex",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "emojilib",
            "direct": false,
            "version": "2.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "env-ci",
            "direct": false,
            "version": "11.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "env-paths",
            "direct": false,
            "version": "2.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "environment",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "error-ex",
            "direct": false,
            "version": "1.3.4",
            "ecosystem": "npm"
          },
          {
            "name": "escalade",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "escape-string-regexp",
            "direct": false,
            "version": "1.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "escape-string-regexp",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "execa",
            "direct": false,
            "version": "5.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "execa",
            "direct": false,
            "version": "8.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "execa",
            "direct": false,
            "version": "9.6.1",
            "ecosystem": "npm"
          },
          {
            "name": "exponential-backoff",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "fastest-levenshtein",
            "direct": false,
            "version": "1.0.16",
            "ecosystem": "npm"
          },
          {
            "name": "fdir",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "figures",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "figures",
            "direct": false,
            "version": "6.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "fill-range",
            "direct": false,
            "version": "7.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "find-up",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "find-up-simple",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "find-versions",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "fs-extra",
            "direct": false,
            "version": "11.3.6",
            "ecosystem": "npm"
          },
          {
            "name": "fs-minipass",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "function-timeout",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "get-caller-file",
            "direct": false,
            "version": "2.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "get-east-asian-width",
            "direct": false,
            "version": "1.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "get-stream",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "get-stream",
            "direct": false,
            "version": "8.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "get-stream",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "git-log-parser",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "glob",
            "direct": false,
            "version": "13.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "graceful-fs",
            "direct": false,
            "version": "4.2.10",
            "ecosystem": "npm"
          },
          {
            "name": "graceful-fs",
            "direct": false,
            "version": "4.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "handlebars",
            "direct": false,
            "version": "4.7.9",
            "ecosystem": "npm"
          },
          {
            "name": "has-flag",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-flag",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "highlight.js",
            "direct": false,
            "version": "10.7.3",
            "ecosystem": "npm"
          },
          {
            "name": "hook-std",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "hosted-git-info",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "hosted-git-info",
            "direct": false,
            "version": "9.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "http-cache-semantics",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "http-proxy-agent",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "http-proxy-agent",
            "direct": false,
            "version": "9.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "https-proxy-agent",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "https-proxy-agent",
            "direct": false,
            "version": "9.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "human-signals",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "human-signals",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "human-signals",
            "direct": false,
            "version": "8.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "iconv-lite",
            "direct": false,
            "version": "0.7.2",
            "ecosystem": "npm"
          },
          {
            "name": "ignore-walk",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "import-fresh",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "import-from-esm",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "import-meta-resolve",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "indent-string",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "indent-string",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "index-to-position",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "inherits",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "ini",
            "direct": false,
            "version": "1.3.8",
            "ecosystem": "npm"
          },
          {
            "name": "ini",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "init-package-json",
            "direct": false,
            "version": "8.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "ip-address",
            "direct": false,
            "version": "10.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-arrayish",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-cidr",
            "direct": false,
            "version": "6.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "is-fullwidth-code-point",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-number",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-obj",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-plain-obj",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-stream",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-stream",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-stream",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-unicode-supported",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "isarray",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "issue-parser",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "java-properties",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "js-tokens",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "js-yaml",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-parse-better-errors",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "json-parse-even-better-errors",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-parse-even-better-errors",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-stringify-nice",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "json-with-bigint",
            "direct": false,
            "version": "3.5.8",
            "ecosystem": "npm"
          },
          {
            "name": "jsonfile",
            "direct": false,
            "version": "6.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "jsonparse",
            "direct": false,
            "version": "1.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "just-diff",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "just-diff-apply",
            "direct": false,
            "version": "5.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmaccess",
            "direct": false,
            "version": "10.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmdiff",
            "direct": false,
            "version": "8.1.11",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmexec",
            "direct": false,
            "version": "10.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmfund",
            "direct": false,
            "version": "7.0.25",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmorg",
            "direct": false,
            "version": "8.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmpack",
            "direct": false,
            "version": "9.1.11",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmpublish",
            "direct": false,
            "version": "11.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmsearch",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmteam",
            "direct": false,
            "version": "8.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "libnpmversion",
            "direct": false,
            "version": "8.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "lines-and-columns",
            "direct": false,
            "version": "1.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "load-json-file",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "locate-path",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "lodash",
            "direct": false,
            "version": "4.18.1",
            "ecosystem": "npm"
          },
          {
            "name": "lodash-es",
            "direct": false,
            "version": "4.18.1",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.capitalize",
            "direct": false,
            "version": "4.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.escaperegexp",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.isplainobject",
            "direct": false,
            "version": "4.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.isstring",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.uniqby",
            "direct": false,
            "version": "4.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "lru-cache",
            "direct": false,
            "version": "10.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "lru-cache",
            "direct": false,
            "version": "11.5.1",
            "ecosystem": "npm"
          },
          {
            "name": "lru-cache",
            "direct": false,
            "version": "11.5.2",
            "ecosystem": "npm"
          },
          {
            "name": "make-asynchronous",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "make-fetch-happen",
            "direct": false,
            "version": "15.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "marked",
            "direct": false,
            "version": "15.0.12",
            "ecosystem": "npm"
          },
          {
            "name": "marked-terminal",
            "direct": false,
            "version": "7.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "meow",
            "direct": false,
            "version": "13.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "merge-stream",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "micromatch",
            "direct": false,
            "version": "4.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "mime",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "mimic-fn",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "mimic-fn",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "minimatch",
            "direct": false,
            "version": "10.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "minimist",
            "direct": false,
            "version": "1.2.8",
            "ecosystem": "npm"
          },
          {
            "name": "minipass",
            "direct": false,
            "version": "3.3.6",
            "ecosystem": "npm"
          },
          {
            "name": "minipass",
            "direct": false,
            "version": "7.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "minipass-collect",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "minipass-fetch",
            "direct": false,
            "version": "5.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "minipass-flush",
            "direct": false,
            "version": "1.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "minipass-pipeline",
            "direct": false,
            "version": "1.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "minipass-sized",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "minizlib",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "ms",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "mute-stream",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "mz",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "negotiator",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "neo-async",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "nerf-dart",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "node-emoji",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "node-gyp",
            "direct": false,
            "version": "12.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "nopt",
            "direct": false,
            "version": "9.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "normalize-package-data",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "normalize-package-data",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "normalize-url",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "npm",
            "direct": false,
            "version": "11.18.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-audit-report",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-bundled",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-install-checks",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-normalize-package-bin",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-package-arg",
            "direct": false,
            "version": "13.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "npm-packlist",
            "direct": false,
            "version": "10.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "npm-pick-manifest",
            "direct": false,
            "version": "11.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "npm-profile",
            "direct": false,
            "version": "12.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "npm-registry-fetch",
            "direct": false,
            "version": "19.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "npm-run-path",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "npm-run-path",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-run-path",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "npm-user-validate",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "object-assign",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "onetime",
            "direct": false,
            "version": "5.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "onetime",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-each-series",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-event",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "p-filter",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-limit",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-locate",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-map",
            "direct": false,
            "version": "7.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "p-map",
            "direct": false,
            "version": "7.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "p-reduce",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-reduce",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-timeout",
            "direct": false,
            "version": "6.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "p-try",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "pacote",
            "direct": false,
            "version": "21.5.1",
            "ecosystem": "npm"
          },
          {
            "name": "parent-module",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "parse-conflict-json",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "parse-json",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "parse-json",
            "direct": false,
            "version": "5.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "parse-json",
            "direct": false,
            "version": "8.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "parse-ms",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "parse5",
            "direct": false,
            "version": "5.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "parse5",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "parse5-htmlparser2-tree-adapter",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-exists",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "path-scurry",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "path-type",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "2.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "pify",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "pkg-conf",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "postcss-selector-parser",
            "direct": false,
            "version": "7.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "pretty-ms",
            "direct": false,
            "version": "9.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "proc-log",
            "direct": false,
            "version": "6.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "process-nextick-args",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "proggy",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "promise-all-reject-late",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "promise-call-limit",
            "direct": false,
            "version": "3.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "promzard",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "proto-list",
            "direct": false,
            "version": "1.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "proxy-agent-negotiate",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "qrcode-terminal",
            "direct": false,
            "version": "0.12.0",
            "ecosystem": "npm"
          },
          {
            "name": "rc",
            "direct": false,
            "version": "1.2.8",
            "ecosystem": "npm"
          },
          {
            "name": "read",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "read-cmd-shim",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "read-package-up",
            "direct": false,
            "version": "11.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "read-package-up",
            "direct": false,
            "version": "12.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "read-pkg",
            "direct": false,
            "version": "10.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "read-pkg",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "readable-stream",
            "direct": false,
            "version": "2.3.8",
            "ecosystem": "npm"
          },
          {
            "name": "registry-auth-token",
            "direct": false,
            "version": "5.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "require-directory",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "safe-buffer",
            "direct": false,
            "version": "5.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "safer-buffer",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "semantic-release",
            "direct": false,
            "version": "25.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "7.8.5",
            "ecosystem": "npm"
          },
          {
            "name": "semver-regex",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "signal-exit",
            "direct": false,
            "version": "3.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "signal-exit",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "signale",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "sigstore",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "skin-tone",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "smart-buffer",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "socks",
            "direct": false,
            "version": "2.8.9",
            "ecosystem": "npm"
          },
          {
            "name": "socks-proxy-agent",
            "direct": false,
            "version": "8.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "source-map",
            "direct": false,
            "version": "0.6.1",
            "ecosystem": "npm"
          },
          {
            "name": "spawn-error-forwarder",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "spdx-correct",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "spdx-exceptions",
            "direct": false,
            "version": "2.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "spdx-expression-parse",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "spdx-expression-parse",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "spdx-license-ids",
            "direct": false,
            "version": "3.0.23",
            "ecosystem": "npm"
          },
          {
            "name": "split2",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "ssri",
            "direct": false,
            "version": "13.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "stream-combiner2",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "string-width",
            "direct": false,
            "version": "4.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "string-width",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "string_decoder",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-ansi",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-ansi",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-bom",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-final-newline",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-final-newline",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-final-newline",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-json-comments",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "super-regex",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "supports-color",
            "direct": false,
            "version": "10.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "supports-color",
            "direct": false,
            "version": "5.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "supports-color",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "supports-hyperlinks",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "tagged-tag",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "tar",
            "direct": false,
            "version": "7.5.19",
            "ecosystem": "npm"
          },
          {
            "name": "temp-dir",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "tempy",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "text-table",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "thenify",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "thenify-all",
            "direct": false,
            "version": "1.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "through2",
            "direct": false,
            "version": "2.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "time-span",
            "direct": false,
            "version": "5.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "tiny-relative-date",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "to-regex-range",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "traverse",
            "direct": false,
            "version": "0.6.8",
            "ecosystem": "npm"
          },
          {
            "name": "treeverse",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "tuf-js",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "tunnel",
            "direct": false,
            "version": "0.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "type-fest",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-fest",
            "direct": false,
            "version": "2.19.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-fest",
            "direct": false,
            "version": "4.41.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-fest",
            "direct": false,
            "version": "5.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-fest",
            "direct": false,
            "version": "5.8.0",
            "ecosystem": "npm"
          },
          {
            "name": "uglify-js",
            "direct": false,
            "version": "3.19.3",
            "ecosystem": "npm"
          },
          {
            "name": "undici",
            "direct": false,
            "version": "6.27.0",
            "ecosystem": "npm"
          },
          {
            "name": "undici",
            "direct": false,
            "version": "7.28.0",
            "ecosystem": "npm"
          },
          {
            "name": "unicode-emoji-modifier-base",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "unicorn-magic",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "unicorn-magic",
            "direct": false,
            "version": "0.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "unicorn-magic",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "unique-string",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "universal-user-agent",
            "direct": false,
            "version": "7.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "universalify",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "url-join",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "util-deprecate",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "validate-npm-package-license",
            "direct": false,
            "version": "3.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "validate-npm-package-name",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "walk-up-path",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "web-worker",
            "direct": false,
            "version": "1.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "wordwrap",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "wrap-ansi",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "wrap-ansi",
            "direct": false,
            "version": "9.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "write-file-atomic",
            "direct": false,
            "version": "7.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "xtend",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "y18n",
            "direct": false,
            "version": "5.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "yallist",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "yallist",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "yargs",
            "direct": false,
            "version": "16.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "yargs",
            "direct": false,
            "version": "18.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "yargs-parser",
            "direct": false,
            "version": "20.2.9",
            "ecosystem": "npm"
          },
          {
            "name": "yargs-parser",
            "direct": false,
            "version": "22.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "yoctocolors",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 450,
        "direct_count": 7,
        "indirect_count": 443
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "wu",
          "commits": 180,
          "avatar_url": "https://avatars.githubusercontent.com/u/52700?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql.yaml",
        "release.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 1,
            "reason": "dependency not pinned by hash detected -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 6,
            "reason": "4 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "a62a9df6e3fad2cd11b5c5db209a18ce192f224d",
        "ran_at": "2026-07-25T05:17:12Z",
        "aggregate_score": 5.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": null,
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/wu/keyop-messenger",
    "host": "github.com",
    "name": "keyop-messenger",
    "owner": "wu"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 54,
      "inputs": {
        "security": 56,
        "vitality": 83,
        "community": 24,
        "governance": 37,
        "engineering": 68
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 83,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 72,
            "inputs": {
              "commits_last_year": 239,
              "human_commit_share": 0.81,
              "days_since_last_push": 3,
              "active_weeks_last_year": 12
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 3 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "12/52 weeks with commits",
                "points": 8.3,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 12
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "239 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 239
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 40,
              "latest_release_tag": "v1.24.3",
              "releases_from_tags": false,
              "days_since_latest_release": 3,
              "mean_days_between_releases": 2.9
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "40 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 40
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 3 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.9 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (BSD-2-Clause)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "BSD-2-Clause"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 37,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 55,
            "inputs": {
              "followers": 43,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "wu",
              "public_repos": 27,
              "account_age_days": 6376
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "43 followers of wu",
                "points": 11.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 43,
                      "login": "wu"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "27 public repos, account ~17 yr old",
                "points": 22.5,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 27
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 17
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/wu/keyop-messenger"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 3
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 3 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "52 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 52
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 68,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 56,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 53,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 5.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "4 existing vulnerabilities detected",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 450 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 450
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "source": "osv",
              "advisories": 4,
              "affected_packages": 4,
              "assessed_packages": 450,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, high 1, moderate 1, unknown 1",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: google.golang.org/grpc v1.82.0 (critical 9.1)",
                "points": 9.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "google.golang.org/grpc v1.82.0 (critical 9.1)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 450,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 82,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 4483
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "81 of 81 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 81,
                      "sampled": 81
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 43904,
              "source_files_sampled": 102,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/102 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 102,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "good",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "example_dirs": [
                "example"
              ],
              "has_mcp_signal": false,
              "api_schema_files": [
                "proto/federation/v1/federation.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "proto/federation/v1/federation.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "proto/federation/v1/federation.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T05:17:18.248704Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/w/wu/keyop-messenger.svg",
  "full_name": "wu/keyop-messenger",
  "license_state": "standard",
  "license_spdx": "BSD-2-Clause"
}