Public recordGood
Software health reportschema 0.27.0 · metrics 2.5.0 · 2026-07-30 23:33 UTC
yawkat / lz4-java
LZ4 compression for Java
yawkat/lz4-java holds a health index of 65 out of 100, placing it in the Good band. It scores highest on Sustainability & Governance (76/100) and lowest on Community & Adoption (32/100). It was last updated 24 days ago. 2 contributors account for most of its recent work.
65
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
65
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 60 is calibrated to 65 on the published index scale (record calibration 2026-08-02).
Ownership
Jonas KonradPersonal account
159 followers239 public repossince Sep 2012Oracle
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish |
|---|---|---|---|---|---|
| Maven | at.yawk.lz4:lz4-java | 1.11.1 | - | 9 | 24 days ago |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
75
Development activity
58Moderate
How it's scored
| 28.8/36 | Push recency — last push 24 days ago |
| 9.7/36 | Commit cadence — 14/52 weeks with commits |
| 18/18 | Commit volume — 112 commits in the last year |
| 1/10 | OpenSSF Scorecard: Maintained — 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 |
Inputs used
| commits_last_year | 112 |
| human_commit_share | 1 |
| days_since_last_push | 24 |
| active_weeks_last_year | 14 |
Release discipline
100Exceptional
How it's scored
| 27/27 | Ships releases — 9 releases published |
| 36/36 | Release recency — latest release 24 days ago |
| 27/27 | Release cadence — a release every ~27.8 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 9 |
| latest_release_tag | v1.11.1 |
| releases_from_tags | no |
| days_since_latest_release | 24 |
| mean_days_between_releases | 27.8 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
32
Popularity & adoption
38Weak
How it's scored
| 27.1/60 | Stars — 48 stars |
| 11/25 | Forks — 22 forks |
| 0/15 | Watchers — 2 watchers |
Inputs used
| forks | 22 |
| stars | 48 |
| watchers | 2 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
25At Risk
How it's scored
| 0/22.5 | README |
| 22.5/22.5 | License — recognized license (Apache-2.0) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | no |
| has_license | no |
| readme_badges | — |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| readme_badge_services | — |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
76
Maintainer resilience (bus factor)
62Moderate
How it's scored
| 25.2/54 | Bus factor — 2 contributor(s) cover half of all commits |
| 13.2/22.5 | Commit distribution — top contributor authored 41% of commits |
| 13.5/13.5 | Contributor breadth — 29 contributors |
| 10/10 | OpenSSF Scorecard: Contributors — project has 9 contributing companies or organizations |
Inputs used
| bus_factor | 2 |
| contributors_sampled | 29 |
| top_contributor_share | 0.414 |
Issue & PR responsiveness
86Excellent
How it's scored
| 38/42 | Issue resolution — 90% of issues closed |
| 29.1/30 | PR acceptance — 31/32 decided PRs merged |
| 0/13 | Newcomer PR acceptance — no first-time contributor's PR decided in 30d |
| 7.5/15 | OpenSSF Scorecard: Code-Review — Found 17/30 approved changesets -- score normalized to 5 |
Inputs used
| merged_prs | 31 |
| open_issues | 2 |
| closed_issues | 19 |
| prs_merged_7d | — |
| prs_decided_7d | — |
| prs_merged_30d | — |
| prs_decided_30d | — |
| issue_closed_ratio | 0.905 |
| closed_unmerged_prs | 1 |
| first_time_authors_30d | — |
| first_time_prs_merged_30d | — |
| first_time_prs_decided_30d | — |
Excluded from scoring (no data or not applicable): newcomer_pr_acceptance. Remaining weights renormalized.
Ownership & stewardship
64Moderate
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 15.8/25 | Owner reach — 159 followers of yawkat |
| 25/25 | Track record — 239 public repos, account ~13 yr old |
Inputs used
| followers | 159 |
| owner_type | User |
| is_verified | — |
| owner_login | yawkat |
| public_repos | 239 |
| account_age_days | 5,060 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
100Exceptional
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on maven |
| 35/35 | Publish recency — latest publish 24 days ago |
| 20/20 | Version history — 9 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | at.yawk.lz4:lz4-java |
| ecosystems | maven |
| any_deprecated | no |
| min_days_since_publish | 24 |
Engineering Quality
Are baseline engineering and documentation practices in place?
63
Engineering practices
72Good
How it's scored
| 24/24 | CI workflows — 3 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 6.4/6.4 | .editorconfig |
| 18/20 | OpenSSF Scorecard: CI-Tests — 26 out of 28 merged PRs checked by a CI test -- score normalized to 9 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | yes |
| has_linter_config | no |
| has_precommit_config | no |
Documentation
50Moderate
How it's scored
| 0/30 | README |
| 25/25 | Documentation directory |
| 15/15 | Documentation / homepage site — https://lz4-java.yawk.at |
| 0/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | https://lz4-java.yawk.at |
| has_readme | no |
| has_docs_dir | yes |
| has_description | no |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
44
Security posture
44Weak
How it's scored
| 6.8/7.5 | Binary-Artifacts — binaries present in source code |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 2.2/2.5 | CI-Tests — 26 out of 28 merged PRs checked by a CI test -- score normalized to 9 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 3.8/7.5 | Code-Review — Found 17/30 approved changesets -- score normalized to 5 |
| 2.5/2.5 | Contributors — project has 9 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 0.8/7.5 | Maintained — 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 4.4 |
Excluded from scoring (no data or not applicable): signed_releases. Remaining weights renormalized.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
48
Agent context & guidance
22At Risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 21.9/40 | Legible commit history — 41 of 100 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.41 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Verify loop (build / test / typecheck)
51Moderate
How it's scored
| 18/18 | One-command bootstrap — docs/justfile |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — Java (statically typed) |
| 0/10 | Reproducible environment |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 100 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | — |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | docs/justfile |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | pom.xml |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Exceptional
How it's scored
| 45/45 | Type-checkable code — Java (statically typed) |
| 55/55 | Manageable file sizes — 0/65 source files over 60KB |
Inputs used
| primary_language | Java |
| largest_source_bytes | 28,411 |
| source_files_sampled | 65 |
| oversized_source_files | 0 |
How it's scored
| 0/40 | API schema (OpenAPI/GraphQL/proto) |
| 0/20 | MCP server |
| 40/40 | Runnable examples — example |
Inputs used
| example_dirs | example |
| has_mcp_signal | no |
| api_schema_files | — |
Key facts
48GitHub stars
29contributors
112commits, last 12 months
24days since last push
9releases
2bus factor
2open issues
Mavenpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- Community profile unavailable
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
Star and fork history 0 ★ / 22 ⇿
0Stars
22Forks
6Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 2Patch 4
OpenSSF Scorecard 4.4 / 10
4.4aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 9 | Binary-Artifacts | binaries present in source code |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 9 | CI-Tests | 26 out of 28 merged PRs checked by a CI test -- score normalized to 9 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 5 | Code-Review | Found 17/30 approved changesets -- score normalized to 5 |
| 10 | Contributors | project has 9 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 1 | Maintained | 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
Direct dependencies 2
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| Maven | biz.aQute.bnd:biz.aQute.bnd.ant | ${bnd.maven.plugin.version} | pom.xml |
| Maven | org.mvel:mvel2 | 2.5.2.Final | pom.xml |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": true,
"size_kb": 13159,
"has_wiki": true,
"homepage": "https://lz4-java.yawk.at",
"languages": {
"C": 18405,
"HTML": 6380,
"Java": 367716,
"Python": 28411
},
"pushed_at": "2026-07-06T09:49:35Z",
"created_at": "2025-08-22T07:22:12Z",
"owner_type": "User",
"updated_at": "2026-07-30T23:13:33Z",
"description": "LZ4 compression for Java",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Java",
"significant_languages": [
"Java"
]
},
"owner": {
"blog": "https://yawk.at/",
"name": "Jonas Konrad",
"type": "User",
"login": "yawkat",
"company": "Oracle",
"location": "Potsdam, Germany",
"followers": 159,
"avatar_url": "https://avatars.githubusercontent.com/u/2395297?v=4",
"created_at": "2012-09-21T18:14:25Z",
"is_verified": null,
"public_repos": 239,
"account_age_days": 5060
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v1.11.1",
"kind": "patch",
"published_at": "2026-07-06T09:49:35Z"
},
{
"tag": "v1.11.0",
"kind": "minor",
"published_at": "2026-04-09T18:00:21Z"
},
{
"tag": "v1.10.4",
"kind": "patch",
"published_at": "2026-03-02T17:22:36Z"
},
{
"tag": "v1.10.3",
"kind": "patch",
"published_at": "2026-01-21T13:06:28Z"
},
{
"tag": "v1.10.2",
"kind": "patch",
"published_at": "2025-12-16T07:49:23Z"
},
{
"tag": "v1.10.1",
"kind": "patch",
"published_at": "2025-12-05T08:35:36Z"
},
{
"tag": "v1.10.0",
"kind": "minor",
"published_at": "2025-12-02T11:34:38Z"
},
{
"tag": "v1.9.0",
"kind": "minor",
"published_at": "2025-11-26T09:01:10Z"
},
{
"tag": "v1.8.1",
"kind": "patch",
"published_at": "2025-11-26T08:52:18Z"
}
],
"recent_commits": [
{
"oid": "dbd86d04b8dd716e1c2bc626be54189997d910da",
"body": "* Fix native streaming XXHash range validation\n\nCo-Authored-By: multicode <multicode@yawk.at>\n\n* Use assertThrows for XXHash validation tests\n\nCo-Authored-By: multicode <multicode@yawk.at>\n\n---------\n\nCo-authored-by: multicode <multicode@yawk.at>",
"is_bot": false,
"headline": "Merge commit from fork",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2026-07-06T09:39:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a5bd584a60058e64b8abd3cd0987b68d22d6392",
"body": "Remove the custom Pygments line separator so highlighted README code blocks render with normal newlines instead of literal <br> tags on the published documentation site.\n\nResolves #51\n\nCo-authored-by: multicode <multicode@yawk.at>",
"is_bot": false,
"headline": "Fix docs code block line breaks (#52)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2026-04-22T08:08:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5049a27b0c5ed288d68a7f81f414fe3369f05e2b",
"body": null,
"is_bot": false,
"headline": "Add testing on native amd64, arm, and riscv runners (#50)",
"author_name": "Ludovic Henry",
"author_login": "luhenry",
"committed_at": "2026-04-09T17:58:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc0e76169ac1dff06982c9ec0e9d2b6b28cd0993",
"body": "Ensure release-triggered docs publishes deploy to the Cloudflare Pages production branch instead of always creating preview deployments.\n\nCo-authored-by: multicode <multicode@yawk.at>",
"is_bot": false,
"headline": "Fix docs production deployment (#49)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2026-04-09T17:05:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91d16090b730f8492f8c648182fb229b42389fdd",
"body": "* Add native fast reset compressors\n\n* Add native fast reset compressor tests\n\n* Simplify byte buffer paths\n\n* Add constructor normalization for compression level and acceleration\n\n* Switch to a lock for guarding the statePtr\n\n* Add missing HC test\n\n* Throw on concurrent close attempt\n\n* Throw on unsupported buffer attempt\n\n* Move shared logic to an abstract base class",
"is_bot": false,
"headline": "Add native fast reset compressors (#44)",
"author_name": "Artsiom Chmutau",
"author_login": "TyomaVader",
"committed_at": "2026-04-09T07:59:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e1221145de3a965461027fd140d3bb0cb617cfe9",
"body": null,
"is_bot": false,
"headline": "Bump checkout action version (#47)",
"author_name": "Artsiom Chmutau",
"author_login": "TyomaVader",
"committed_at": "2026-04-08T19:22:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed8f477ff490b2caac2a0e734591ac4036a4fce7",
"body": null,
"is_bot": false,
"headline": "Add linux-riscv64 binary (#46)",
"author_name": "Ludovic Henry",
"author_login": "luhenry",
"committed_at": "2026-04-08T19:21:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de5e4dba57119f679be8fe016299ac0566a43501",
"body": "* Make Linux native flags architecture-safe in CI\n\n* Fix workflow matrix expressions for manual dispatch\n\n* Merge x86 flags into arch-specific workflow cflags",
"is_bot": false,
"headline": "Fix Linux native flags for non-x86 CI builds (#42)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2026-03-02T17:21:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f6591316ee8da86fc3ab49088fd602ba43e17464",
"body": null,
"is_bot": false,
"headline": "Tune Linux native build flags and xxhash compilation (#41)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2026-03-02T16:42:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af57e230ed21ab71b227fc0ea038b10b5020deea",
"body": null,
"is_bot": false,
"headline": "fix NPE in available() (#40)",
"author_name": "dldnhf",
"author_login": "dldnhf",
"committed_at": "2026-01-21T13:05:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "384ade4e11ca33002e600449682e5ebb63b85ac8",
"body": null,
"is_bot": false,
"headline": "Improve README formatting (#37)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2026-01-01T20:01:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8af36248bb628784dedd141d2f8ad6c52ea4156",
"body": "* github-pages documentation\n\n* fix\n\n* versioning\n\n* use cloudflare pages instead\n\n* top-level redirect\n\n* update readme links\n\n* disable pull_request trigger",
"is_bot": false,
"headline": "github-pages documentation (#32)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-16T14:05:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3aa42cc8367331993a616b1b0a00baeafb3247c",
"body": null,
"is_bot": false,
"headline": "Use bnd-maven-plugin to fix osgi manifest headers (#28)",
"author_name": "aptmac",
"author_login": "aptmac",
"committed_at": "2025-12-16T06:33:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef125a1566794445936a7fb0899834cda652a381",
"body": "…l/windows/amd64/liblz4-java.dll (#25)",
"is_bot": false,
"headline": "Rename net/jpountz/util/win32/amd64/liblz4-java.so to net/jpountz/uti…",
"author_name": "Haonan",
"author_login": "HTHou",
"committed_at": "2025-12-08T21:06:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1dfbefd41468fcaeb2382bd65aab2e4772646440",
"body": "* Improve `LZ4FrameIOStreamTest` test\n\n- Fix temp file setup always using `0xDEADBEEF` as value, discarding data from Random\n- When running in CI ensure that LZ4 CLI is available\n\n* Fail fast if LZ4 CLI is not available for CI",
"is_bot": false,
"headline": "Improve `LZ4FrameIOStreamTest` test (#23)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-08T21:05:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de1e43edff0c1bb03838babcdf71105377103d4a",
"body": "* Use gcc included in Windows image for release build\n\nSee https://github.com/actions/runner-images/blob/win25/20251125.122/images/windows/Windows2025-Readme.md#tools\n\n* Use bash shell for Windows\n\n* Download LZ4 CLI for Windows build",
"is_bot": false,
"headline": "Use gcc included in Windows image for release build (#22)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-08T21:04:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ece12a466033a77196259d685c06a4183be9783",
"body": "* Migrate to macOS 15 x86_64 for release build\n\nBecause macOS 13 image is deprecated, see https://redirect.github.com/actions/runner-images/issues/13046\r\n\r\nAlso adjusts the build setup a bit to make it easier to understand.\n\n* Rename matrix variable",
"is_bot": false,
"headline": "Migrate to macOS 15 x86_64 for release build (#21)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-06T16:39:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "37d698a89470468f5f42d9327099e18ce1f28fd7",
"body": "- Give \"Setup Temurin JDK\" steps different names to tell them apart\r\n- Fix native binary file names not being printed because they are too deeply nested",
"is_bot": false,
"headline": "Improve publish workflow (#19)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-05T17:53:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c49107994d649a85846c02c6ad3d324a3272b99e",
"body": "* Fix source code formatting\n\n* Add Override annotations",
"is_bot": false,
"headline": "Fix source code formatting (#18)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-05T16:39:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eed5aa0e7f6c971487d9a0b4f3f857d5ff022a43",
"body": null,
"is_bot": false,
"headline": "Add `.git-versioned-pom.xml` to .gitignore (#16)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-05T16:36:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17f0e7ad6afb76e8e7b34a240208d6796f42cf70",
"body": null,
"is_bot": false,
"headline": "Run tests for pull requests again (#17)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-05T16:35:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "37d6ca4d6d9d731cc599146160816f03d7307e6b",
"body": "It's still not easy to reproduce due to the multi-platform nature of the build, but this should reduce the diff between versions somewhat.",
"is_bot": false,
"headline": "Reproducible build (#15)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-05T11:36:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33d180cb70c4d93c80fb0dc3ab3002f457e93840",
"body": "* Add test case\n\n* Add patch\n\n* move after destEnd check\n\n* fix",
"is_bot": false,
"headline": "Merge commit from fork",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-05T08:34:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da95a00f707645eb9ea686f224523c3d55923968",
"body": null,
"is_bot": false,
"headline": "Copy native libraries to target/classes instead of src/resources (#14)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-04T10:46:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e9bf8ce0d6221e26824562ebf35410e4d4968a1",
"body": "…g without release (#13)\n\n* Add manual workflow_dispatch trigger to multi-platform build\n\n* disable redundant test workflow for pull_request",
"is_bot": false,
"headline": "Add workflow_dispatch trigger to multi-platform build to allow testin…",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-04T10:19:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89c02be6ff8017b14ccb2566cc7ec44f3a516e0f",
"body": "This extension is maintained and allows us to do proper SNAPSHOT builds.",
"is_bot": false,
"headline": "Migrate to maven-git-versioning-extension (#10)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-03T12:17:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9488323123899f90041187c20801deabcae1bef",
"body": "Clarify note about stateful checksum objects in documentation.",
"is_bot": false,
"headline": "Update documentation for checksum registration (#8)",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-02T13:40:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02bbbf0ee67fe78f3e56a1a5a91d0694f61d50ba",
"body": null,
"is_bot": false,
"headline": "Add test for corrupted LZ4 block input stream (#7)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-02T13:40:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2d01a7330c4c4a91d99526f01b3a288ac4b1cd0",
"body": "…(#6)\n\nAn ArrayIndexOutOfBoundsException could indicate either an out-of-bounds access, or invalid arguments (e.g. offset < 0). Since we want to detect the former in the fuzz tests, we need to make sure the latter doesn't happen. This PR:\n\n- Disables the ArrayIndexOutOfBoundsException catch so that \n[…]\n is also disabled by default due to CVE-2025-12183)\n\nWith these changes, a quick fuzz run now only shows the native_fast_* tests failing, both with a segfault, which is expected due to CVE-2025-12183.",
"is_bot": false,
"headline": "Fix remaining ArrayIndexOutOfBoundsExceptions in LZ4DecompressorTest …",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-12-02T11:28:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "999c4010387def72230184976e05767a91335653",
"body": "- added builder for LZ4BlockInputStream which accepts both fast and safe decompressor (prefers fast one)\n\nCo-authored-by: Mihhail Meshkov <mihhail.meshkov@dynatrace.com>",
"is_bot": false,
"headline": "Allow to create LZ4BlockInputStream with LZ4SafeDecompressor (#3)",
"author_name": "Mihhail Meshkov",
"author_login": "meshcow",
"committed_at": "2025-12-02T09:48:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a238b6d44843ea201c80cf9b49d1a08cc488be0",
"body": "This matches the original Ant build:\r\nhttps://github.com/lz4/lz4-java/blob/be9ce5759ec6cce99544c7112e434be11aedb1a8/build.xml#L336",
"is_bot": false,
"headline": "Hide `util` package from Javadoc (#4)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-01T21:13:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb16cca6c37c63b9387b0bb6305b4bb96ff7e361",
"body": null,
"is_bot": false,
"headline": "Remove unused POM template files (#1)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-01T21:00:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4909333e8fe73a0b1cd791b6ccd7725a3d8aa03",
"body": "* Replace old repository links & improve README\n\n* Apply suggestion from @yawkat\n\n---------\n\nCo-authored-by: Jonas Konrad <me@yawk.at>",
"is_bot": false,
"headline": "Replace old repository links & improve README (#2)",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-12-01T20:58:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "358ee5039f13005f57be6f4a77430e19ace04c61",
"body": null,
"is_bot": false,
"headline": "update readme",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-26T08:43:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c833ad3395188a2a6025114da710489faac40e8f",
"body": null,
"is_bot": false,
"headline": "forgot to include the credential setup",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-26T07:40:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fada758bc1f63e4db52a48fc59d7511e9c95028c",
"body": null,
"is_bot": false,
"headline": "update actions for main branch",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-26T07:23:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "beb32017a0a8137a4f15994fd26ad4da179cadfd",
"body": "# Conflicts:\n#\tpom.xml",
"is_bot": false,
"headline": "Merge branch '1.8.1'",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-26T07:17:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d041c28d3d4cd734d7c238206a27fd4768abb21d",
"body": null,
"is_bot": false,
"headline": "also needs an execution",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-26T07:08:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fa779db553b5e14e2cc356d31d05f755c21bf99",
"body": null,
"is_bot": false,
"headline": "Add gradle capabilities",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-26T06:53:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7aa7a0d697741b1eaa40e2b589915e4a8049c65",
"body": null,
"is_bot": false,
"headline": "this should work",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-25T18:14:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75ed7bcc6373ca2480ee49a10ca1c4d7966f3dfd",
"body": null,
"is_bot": false,
"headline": "maybe it works with corretto 21?",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-25T18:11:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb7a96d9fbbb6ce1ee9d92a853baadb6b060c873",
"body": null,
"is_bot": false,
"headline": "jdk 17",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-25T18:09:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e578b95d55b8a618de02a1170ce523e161df9512",
"body": null,
"is_bot": false,
"headline": "use maven wrapper",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-25T18:04:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7083594bc1c71ee16a90a1105c03ef7a221ddada",
"body": null,
"is_bot": false,
"headline": "config for publishing",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-25T18:03:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b99d8360446d73da64677eb20576153b768a5095",
"body": null,
"is_bot": false,
"headline": "version 1.8.1",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-21T16:50:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53b7a487f8378f0c594c1cff17d248a3a4d41b4b",
"body": "Fail fast for `literalLen` and `matchLen` overflow",
"is_bot": false,
"headline": "Merge pull request #13 from yawkat/overflow-fail-fast",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-10T07:42:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd651aeaaed7c36b7bc0709c86976923a83004ef",
"body": "Without these checks the previous implementation would not have detected\nrepeated overflows, causing the value to become 'valid' again.\n\nThe other existing checks are still needed though in case the `...Len`\nvalues themselves do not overflow, but only overflow once added to `dOff`.",
"is_bot": false,
"headline": "Fail fast for `literalLen` and `matchLen` overflow",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-08T23:58:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7172a3e9c654633b600ab646fc010bb66c619a80",
"body": "Extend out-of-bounds test",
"is_bot": false,
"headline": "Merge pull request #12 from yawkat/overflow-tests",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-08T20:50:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "271f91a05ad7d6a1639811a8b9eb107431037c13",
"body": null,
"is_bot": false,
"headline": "Extend out-of-bounds test",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-08T20:40:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8b146476e26a5c5434d25013c77a656a172dfb5",
"body": "# Conflicts:\n#\tivy-pure-java.xml\n#\tivy.xml\n#\tsrc/resources/net/jpountz/util/darwin/aarch64/liblz4-java.dylib\n#\tsrc/resources/net/jpountz/util/darwin/x86_64/liblz4-java.dylib\n#\tsrc/resources/net/jpountz/util/linux/aarch64/liblz4-java.so\n#\tsrc/resources/net/jpountz/util/linux/ppc64le/liblz4-java.so\n#\tsrc/resources/net/jpountz/util/linux/s390x/liblz4-java.so",
"is_bot": false,
"headline": "Merge remote-tracking branch 'refs/remotes/origin/master'",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-07T20:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83116d99af2026645d9f0d488b87dbad64b69612",
"body": "Refactor bounds checks to be less prone to overflow",
"is_bot": false,
"headline": "Merge pull request #11 from yawkat/bounds-checks-overflow",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-07T20:25:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1978d164193011c1381a458726ea64a6a8674101",
"body": null,
"is_bot": false,
"headline": "small changes",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-07T20:25:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f64e4205f4ad3695847ffd66cd85e1f5563fb83",
"body": "Perform `ByteBuffer` range checks before delegating to `byte[]` overload",
"is_bot": false,
"headline": "Merge pull request #10 from yawkat/bytebuffer-range-check",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-07T13:45:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9c3b7764e0842e1614e785094af6721bcb24a13",
"body": "…riteLen`",
"is_bot": false,
"headline": "Use same constants for `lengthOfEncodedInteger` used by callers of `w…",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-07T13:33:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "209b0acd96cd28fad21dc42589d24e0bb11bd496",
"body": null,
"is_bot": false,
"headline": "Refactor bounds checks to be less prone to overflow",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-07T13:22:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff972708a6dc32ee246e455e39c6949f7a6f7c26",
"body": null,
"is_bot": false,
"headline": "Perform `ByteBuffer` range checks before delegating to `byte[]` overload",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-06T13:14:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70f872dcb7f888b4497940fd56d56fc073e4231c",
"body": "Add missing len check for fast decompressor",
"is_bot": false,
"headline": "Merge pull request #9 from yawkat/fast-decompressor-len-check",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-06T08:46:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9420d994ec1511dbbfead25ecd0d0a7e87736a01",
"body": null,
"is_bot": false,
"headline": "Add comment",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-05T21:03:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20c0064b5ee4af79c466403b6b43e87c4588d415",
"body": null,
"is_bot": false,
"headline": "Add missing len check for fast decompressor",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-05T19:04:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a64886594bb79754d7e9a56ab41a16e54820dc8b",
"body": null,
"is_bot": false,
"headline": "disable build-all in PR too",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T19:02:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c9fe6e934590d1855f984a97b38c49cd640d067",
"body": "Use `lengthOfEncodedInteger` in compressor template",
"is_bot": false,
"headline": "Merge pull request #8 from yawkat/compressor-lengthOfEncodedInteger",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-05T19:02:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5d08450fdac80cafbdd7c552a6a96db317dc892",
"body": null,
"is_bot": false,
"headline": "Use `lengthOfEncodedInteger` in compressor template",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-05T18:38:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ea4b51c92aac2878c5f24e91f953e36ee23f147",
"body": "Fixes #5",
"is_bot": false,
"headline": "Respect buffer capacity in fast decompressors",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T18:01:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0eded6eba4fa8199ca37ee731bbc485202a919e3",
"body": null,
"is_bot": false,
"headline": "use junit 5 for OutOfBoundsTest",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T17:37:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85f9c038dc8a66623232fbe36894063716521607",
"body": null,
"is_bot": false,
"headline": "action name",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T17:31:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f10f17e2212ffece20b146b08077d3ad2981b447",
"body": null,
"is_bot": false,
"headline": "only run linux build by default, to save credits",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T17:30:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f3fcd65243027b6872939b096ececed4dd287c03",
"body": "Add missing `Unsafe` bounds checks",
"is_bot": false,
"headline": "Merge pull request #2 from yawkat/marcono1234/bounds-checks",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-05T17:19:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a35abd155bba3df52024fd84549eede22097a15",
"body": null,
"is_bot": false,
"headline": "CR",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T16:35:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b5f0d8e29c8b90c6316b6fc14946d60f84b135a",
"body": null,
"is_bot": false,
"headline": "Merge branch 'refs/heads/main' into marcono1234/bounds-checks",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T16:20:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f077c84e84d1231198d59bf8a29ed5354475026",
"body": null,
"is_bot": false,
"headline": "fix lengthOfEncodedInteger",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T14:23:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c778e58af8cdccbd8d2685b616f090e5219b3c55",
"body": "Remove redundant `skipTests` for fuzz tests",
"is_bot": false,
"headline": "Merge pull request #7 from yawkat/pom-skipTests",
"author_name": "Jonas Konrad",
"author_login": "yawkat",
"committed_at": "2025-11-05T14:08:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a6c7ce2b85c066bc2bad0da563b46170ed07bc93",
"body": null,
"is_bot": false,
"headline": "check computed end == dOff",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T13:53:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34598a434c1e0ee050157a45e1ef0f969b6fb944",
"body": null,
"is_bot": false,
"headline": "Remove redundant `skipTests` for fuzz tests",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-05T13:43:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "37a4ffc39a4eca35580b5d4082f7aab95a35eb5a",
"body": null,
"is_bot": false,
"headline": "remove ArrayIndexOutOfBoundsException",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T13:22:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f7fc9197b06bb9898b68d26005ff67ed203f9246",
"body": null,
"is_bot": false,
"headline": "apply suggestions",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T11:12:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc5839445743e7e5cc65b1bec6ffaa254acb9ff3",
"body": null,
"is_bot": false,
"headline": "fix test",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T09:40:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1299238711abacc8e7918e6a6b572eacb2bade16",
"body": null,
"is_bot": false,
"headline": "remove redundant check",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T09:36:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e87a0ddfe2d6ed181618fb479163f7a0e03063a",
"body": "# Conflicts:\n#\tsrc/build/source_templates/decompress.template",
"is_bot": false,
"headline": "Merge branch 'main' into marcono1234/bounds-checks",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-05T09:33:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "854f493cd26ac56e1d84fe34ce808c3b6821ce21",
"body": null,
"is_bot": false,
"headline": "Fix out-of-bounds write in unsafe encodeSequence",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-03T09:30:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f5d9276749c67f0130c3363343c594b8e8e4c4e",
"body": null,
"is_bot": false,
"headline": "Fix fuzz_runner not seeing changes",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-03T09:29:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf11258de213ea4636cb225acf94c84571aae000",
"body": null,
"is_bot": false,
"headline": "Fix out-of-bounds token read in safe decoders",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-11-03T09:29:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88eb9d1159d5f8c7f5964106af7eb1558aed0c64",
"body": null,
"is_bot": false,
"headline": "Fix code generation for decompress `ByteBuffer`",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-01T22:18:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "855308648230792fe6ed6d5e35bf64b1eed25e07",
"body": null,
"is_bot": false,
"headline": "Add missing bounds & overflow checks for decompressors",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-01T21:53:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "47347f042bdde8cbcbcffaa578493644b5941ac6",
"body": null,
"is_bot": false,
"headline": "Add missing bounds check for `LZ4HCJavaUnsafeCompressor`",
"author_name": "Marcono1234",
"author_login": "Marcono1234",
"committed_at": "2025-11-01T21:52:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73bb916740e4366d0ce75d2fe94b4d3d5751a5b4",
"body": null,
"is_bot": false,
"headline": "add script for running fuzz tests in parallel",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-31T16:20:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4222c25044917f701497fdb22af90b5a96100298",
"body": null,
"is_bot": false,
"headline": "fix test",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-31T15:04:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4ff03a848dce850d43b11f767eb306f650c23f3",
"body": null,
"is_bot": false,
"headline": "fuzzers",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-31T14:55:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dac4d4f5404df8844e2b7ea3e7f613a00de5a19b",
"body": null,
"is_bot": false,
"headline": "fuzzer template",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-31T12:13:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbab71e4648f972fa5d7df9daa349388f4ad4d6b",
"body": null,
"is_bot": false,
"headline": "remove manual toolchain declaration",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-31T12:11:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "51390a63f9100ac50ab86771b2f425a4d45b9d71",
"body": null,
"is_bot": false,
"headline": "disable workflow branch",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:45:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f67e498c78150b0017f95d8530861c065f3d8f7",
"body": null,
"is_bot": false,
"headline": "maven descriptor",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:38:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "254dd275279d8a1163a306085bc16731737eb851",
"body": null,
"is_bot": false,
"headline": "add editorconfig",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:37:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dce74689fd8ffe3b201bc0cdefd7adf1374fa02b",
"body": null,
"is_bot": false,
"headline": "remove old build files",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:37:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea8a19315bf5258c18592eb7d6cd9549b1489189",
"body": null,
"is_bot": false,
"headline": "fix windows tests",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:30:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f4cfdd7df767000bcd3830f39b6cd660164abe9d",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:17:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5792807ea851e5c55b02037719995539e8e34c3b",
"body": null,
"is_bot": false,
"headline": "verify",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T20:06:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "926bcab69000734827f39cfbc97b9c6d73a13418",
"body": null,
"is_bot": false,
"headline": "get rid of shared libs in source tree",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T19:55:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06f9850f2cf7d64dfdc2c80df80cca1537bed305",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T19:34:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac74706446b8265e05e07dfc2181a917a3358e24",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T19:24:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de663909392e6b5c42d326d01decef948333337e",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "yawkat",
"author_login": "yawkat",
"committed_at": "2025-10-30T19:20:45Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 9,
"commits_last_year": 112,
"latest_release_at": "2026-07-06T09:49:35Z",
"latest_release_tag": "v1.11.1",
"releases_from_tags": false,
"days_since_last_push": 24,
"active_weeks_last_year": 14,
"days_since_latest_release": 24,
"mean_days_between_releases": 27.8
},
"community": {
"has_readme": false,
"has_license": false,
"has_description": false,
"has_contributing": false,
"health_percentage": null,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "at.yawk.lz4:lz4-java",
"exists": true,
"license": "Apache License, Version 2.0",
"keywords": [],
"ecosystem": "maven",
"matches_repo": true,
"registry_url": "https://central.sonatype.com/artifact/at.yawk.lz4/lz4-java",
"is_deprecated": false,
"latest_version": "1.11.1",
"repository_url": "https://github.com/yawkat/lz4-java",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-06T10:18:01Z",
"latest_version_yanked": null,
"days_since_latest_publish": 24
}
]
},
"popularity": {
"forks": 22,
"stars": 48,
"watchers": 2,
"fork_history": {
"days": [
{
"date": "2025-12-01",
"count": 2
},
{
"date": "2025-12-03",
"count": 1
},
{
"date": "2025-12-05",
"count": 1
},
{
"date": "2025-12-08",
"count": 1
},
{
"date": "2025-12-17",
"count": 1
},
{
"date": "2025-12-20",
"count": 2
},
{
"date": "2026-01-08",
"count": 1
},
{
"date": "2026-01-11",
"count": 1
},
{
"date": "2026-01-12",
"count": 8
},
{
"date": "2026-01-19",
"count": 1
},
{
"date": "2026-01-24",
"count": 1
},
{
"date": "2026-04-08",
"count": 1
},
{
"date": "2026-05-26",
"count": 1
}
],
"complete": true,
"collected": 22,
"total_forks": 22
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"example"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"docs/justfile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"pom.xml"
],
"largest_source_bytes": 28411,
"source_files_sampled": 65,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"pom.xml"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"maven"
],
"dependencies": [
{
"name": "biz.aQute.bnd:biz.aQute.bnd.ant",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${bnd.maven.plugin.version}"
},
{
"name": "org.mvel:mvel2",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "2.5.2.Final"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 31,
"open_issues": 2,
"closed_ratio": 0.905,
"closed_issues": 19,
"closed_unmerged_prs": 1
},
"bus_factor": 2,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "jpountz",
"commits": 233,
"avatar_url": "https://avatars.githubusercontent.com/u/299848?v=4"
},
{
"type": "User",
"login": "odaira",
"commits": 172,
"avatar_url": "https://avatars.githubusercontent.com/u/11302045?v=4"
},
{
"type": "User",
"login": "yawkat",
"commits": 80,
"avatar_url": "https://avatars.githubusercontent.com/u/2395297?v=4"
},
{
"type": "User",
"login": "Marcono1234",
"commits": 24,
"avatar_url": "https://avatars.githubusercontent.com/u/11685886?v=4"
},
{
"type": "User",
"login": "linnaea",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/1358999?v=4"
},
{
"type": "User",
"login": "blambov",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/8417529?v=4"
},
{
"type": "User",
"login": "danielfree",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/126425?v=4"
},
{
"type": "User",
"login": "maropu",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/692303?v=4"
},
{
"type": "User",
"login": "Cyan4973",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/750081?v=4"
},
{
"type": "User",
"login": "magnet",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/67098?v=4"
}
],
"contributors_sampled": 29,
"top_contributor_share": 0.414
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"build-all-and-publish.yml",
"docs.yml",
"test.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": true,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 9,
"reason": "binaries present in source code",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 9,
"reason": "26 out of 28 merged PRs checked by a CI test -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 5,
"reason": "Found 17/30 approved changesets -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 9 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 1,
"reason": "1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "dbd86d04b8dd716e1c2bc626be54189997d910da",
"ran_at": "2026-07-30T23:33:27Z",
"aggregate_score": 4.4,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-06T10:12:01Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-04-22T08:08:16Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 35,
"created_at": "2025-12-18T23:48:59Z",
"last_comment_at": "2025-12-19T06:01:55Z",
"last_comment_author": "yawkat"
},
{
"number": 54,
"created_at": "2026-06-18T09:37:18Z",
"last_comment_at": "2026-07-08T07:00:50Z",
"last_comment_author": "HTHou"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/yawkat/lz4-java",
"host": "github.com",
"name": "lz4-java",
"owner": "yawkat"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": "The weighted overall 60 is calibrated to 65 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 60,
"calibrated": 65,
"calibration": "2026-08-02"
}
}
],
"value": 65,
"inputs": {
"security": 44,
"vitality": 75,
"community": 32,
"governance": 76,
"calibration": "2026-08-02",
"engineering": 63,
"ai_readiness": 48,
"weighted_overall_raw": 60
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 75,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"commits_last_year": 112,
"human_commit_share": 1,
"days_since_last_push": 24,
"active_weeks_last_year": 14
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 24 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 24
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "14/52 weeks with commits",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 14
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "112 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 112
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 9,
"latest_release_tag": "v1.11.1",
"releases_from_tags": false,
"days_since_latest_release": 24,
"mean_days_between_releases": 27.8
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "9 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 9
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 24 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 24
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~27.8 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 27.8
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 29,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 29 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 29
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 32,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "weak",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 38,
"inputs": {
"forks": 22,
"stars": 48,
"watchers": 2,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "48 stars",
"points": 27.1,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 48
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "22 forks",
"points": 11,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 22
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "2 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 2
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "at_risk",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": false,
"has_license": false,
"readme_badges": null,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 76,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 62,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 29,
"top_contributor_share": 0.414
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 41% of commits",
"points": 13.2,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 41
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "29 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 29
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 9 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 86,
"inputs": {
"merged_prs": 31,
"open_issues": 2,
"closed_issues": 19,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.905,
"closed_unmerged_prs": 1,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "90% of issues closed",
"points": 38,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 90
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "31/32 decided PRs merged",
"points": 29.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 31,
"decided": 32
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 17/30 approved changesets -- score normalized to 5",
"points": 7.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 64,
"inputs": {
"followers": 159,
"owner_type": "User",
"is_verified": null,
"owner_login": "yawkat",
"public_repos": 239,
"account_age_days": 5060
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "159 followers of yawkat",
"points": 15.8,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 159,
"login": "yawkat"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "239 public repos, account ~13 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 239
}
},
{
"code": "account_age_years",
"params": {
"years": 13
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"at.yawk.lz4:lz4-java"
],
"ecosystems": "maven",
"any_deprecated": false,
"min_days_since_publish": 24
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on maven",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "maven"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 24 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 24
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "9 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 9
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 63,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "26 out of 28 merged PRs checked by a CI test -- score normalized to 9",
"points": 18,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": "https://lz4-java.yawk.at",
"has_readme": false,
"has_docs_dir": true,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://lz4-java.yawk.at",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "weak",
"name": "Security",
"value": 44,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "weak",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 44,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4.4
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "binaries present in source code",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "26 out of 28 merged PRs checked by a CI test -- score normalized to 9",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 17/30 approved changesets -- score normalized to 5",
"points": 3.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 9 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 11
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "weak",
"name": "AI Readiness",
"value": 48,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.41,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "41 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 21.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 41,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"docs/justfile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"pom.xml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "docs/justfile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "docs/justfile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Java (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Java"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "exceptional",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Java",
"largest_source_bytes": 28411,
"source_files_sampled": 65,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Java (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Java"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/65 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 65,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "weak",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"example"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "example",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "example"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"top": [
"library"
],
"labels": [
"library"
],
"scores": {
"library": 6
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:maven",
"weight": 6
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": false,
"consumed_by_code": true
},
"metrics_version": "2.5.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Community profile unavailable",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-30T23:33:52.600548Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/y/yawkat/lz4-java.svg",
"full_name": "yawkat/lz4-java",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.5.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — Maven.