getlantern/lantern-box має індекс здоров’я 57 зі 100, що відповідає смузі «Помірний». Найвищий показник — Vitality (94/100), найнижчий — Community & Adoption (23/100). Останнє оновлення було 4 дні тому. Більшість нещодавньої роботи виконує один учасник.
57
загалом / 100
Помірний
Індекс здоров'я програмного забезпечення
Метрики згруповано у зважені категорії на шкалі 1–100. Загальна оцінка починається як їхнє середнє; коли публічні дані активують Політику юрисдикцій високого ризику, рейтинг коригується й отримує верхню межу 49 («Під ризиком»). Готовність до ШІ не входить до індексу.
57
Відмінний85-100Зразковий; відповідає практично всім перевіреним критеріям
Добрий70-84Здоровий; незначні прогалини
Помірний50-69Прийнятний, але з помітними прогалинами; рекомендовано перевірку
У зоні ризику30-49Суттєві слабкі місця; впровадження потребує обережності
Критичний1-29Серйозні проблеми (покинутий, єдиний мейнтейнер, без базової гігієни)
Профіль оцінок
Кожна вісь — окрема категорія. Форма важить більше, ніж середнє: здоровий об'єкт заповнює всю фігуру, тоді як профіль із піками та провалами означає, що сила в одному вимірі маскує ризик в іншому.
Прямі залежності без відомих сповіщень — уражено 4: go.opentelemetry.io/otel/sdk v1.41.0 (high 7.0), go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 (moderate 5.3), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.41.0 (moderate 5.3), ще +1
0/25
Непрямі залежності без відомих сповіщень — транзитивний набір не відокремлюється від залежностей розробки й тестування в цьому обсязі
25.4/40
Немає задавнених сповіщень — 4 пакет(ів) зі сповіщеннями без реакції понад 90 дн.; найдавніше опубліковано 104 дн. тому
Використані вхідні дані
source
osv
advisories
66
affected_packages
13
assessed_packages
278
unassessed_packages
0
affected_by_severity
critical 2, high 2, moderate 6, low 1, unknown 2
direct_affected_packages
4
Виключено з оцінювання (немає даних або не застосовно): Непрямі залежності без відомих сповіщень. Залишкові ваги перенормовано. Звірено 278 резолвлених залежностей із OSV. Цей репозиторій не публікує пакета, який резолвить індекс, тож натомість оцінено граф залежностей репозиторію. Цей граф змішує закріплені версії для розробки й тестування зі справді постачаними залежностями, тож оцінюються лише задекларовані runtime-залежності; транзитивні знахідки подаються як контекст і в оцінку не входять. Досяжність не аналізується.
Наскільки репозиторій оснащений для розробки та супроводу за участі ШІ-агентів? Незалежний, експериментальний бейдж — вага 0.0, тож він подається окремо і не впливає на загальний індекс здоров'я.
Керовані розміри файлів — 0/120 файлів вихідного коду понад 60 КБ
Використані вхідні дані
primary_language
Go
largest_source_bytes
50 657
source_files_sampled
120
oversized_source_files
0
Ключові факти
10зірок GitHub
8контриб'юторів
606комітів за останні 12 місяців
4днів від останнього пушу
99релізів
1бас-фактор
1відкритих issue
Goпакетних екосистем
Попередження щодо збору даних
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Докладніше
Історія зірок і форків 0 ★ / 3 ⇿
0Зірки
3Форки
78Релізи
Коли додано кожну зірку й форк — зібрано з GitHub і згруповано за днями. Кумулятивне зростання розміщено просто над денними додаваннями, з яких воно складається, тож їх видно одне проти одного: рівномірне органічне накопичення виглядає зовсім інакше, ніж різкий короткочасний сплеск. Там, де цю різницю можна виміряти, її подано як автентичність росту.
Мажорні 0Мінорні 0Патчі 78
OpenSSF Scorecard 3.6 / 10
3.6сукупно
Незалежна, не прив'язана до інструментів оцінка безпеки від відкритого проєкту OpenSSF Scorecard. Кожна перевірка винагороджує практику безпеки, а не інструмент конкретного постачальника. Перевірки, які Scorecard не зміг визначити, позначено н/д і виключено з оцінки безпеки (вони ніколи не зараховуються як нуль).Scorecard v5.5.0 · 2026-07-22 15:40 UTC
Повний розв'язаний набір залежностей із графа залежностей GitHub: 26 прямих і 252 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.
Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 278 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 13 мають відомі сповіщення, з них 4 прямі.
Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.
Звіт у форматі JSON машиночитний
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 98369,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 706791,
"HCL": 46992,
"Shell": 22540,
"Makefile": 303,
"Dockerfile": 1403
},
"pushed_at": "2026-07-17T22:42:13Z",
"created_at": "2025-03-24T17:58:19Z",
"owner_type": "Organization",
"updated_at": "2026-07-17T22:42:08Z",
"description": "lantern-box",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://lantern.io",
"name": "Lantern",
"type": "Organization",
"login": "getlantern",
"company": null,
"location": null,
"followers": 1274,
"avatar_url": "https://avatars.githubusercontent.com/u/624178?v=4",
"created_at": "2011-02-17T22:10:55Z",
"is_verified": null,
"public_repos": 475,
"account_age_days": 5633
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v0.0.104",
"kind": "patch",
"published_at": "2026-07-17T22:46:43Z"
},
{
"tag": "v0.0.103",
"kind": "patch",
"published_at": "2026-07-17T20:40:52Z"
},
{
"tag": "v0.0.102",
"kind": "patch",
"published_at": "2026-07-17T11:48:28Z"
},
{
"tag": "v0.0.101",
"kind": "patch",
"published_at": "2026-07-09T18:14:51Z"
},
{
"tag": "v0.0.100",
"kind": "patch",
"published_at": "2026-07-06T18:45:58Z"
},
{
"tag": "v0.0.99",
"kind": "patch",
"published_at": "2026-07-02T19:34:34Z"
},
{
"tag": "v0.0.98",
"kind": "patch",
"published_at": "2026-06-30T20:14:22Z"
},
{
"tag": "v0.0.97",
"kind": "patch",
"published_at": "2026-06-27T14:44:13Z"
},
{
"tag": "v0.0.96",
"kind": "patch",
"published_at": "2026-06-26T15:04:30Z"
},
{
"tag": "v0.0.95",
"kind": "patch",
"published_at": "2026-06-18T21:03:19Z"
},
{
"tag": "v0.0.94",
"kind": "patch",
"published_at": "2026-06-18T15:14:59Z"
},
{
"tag": "v0.0.93",
"kind": "patch",
"published_at": "2026-06-17T19:30:57Z"
},
{
"tag": "v0.0.92",
"kind": "patch",
"published_at": "2026-06-16T12:17:05Z"
},
{
"tag": "v0.0.91",
"kind": "patch",
"published_at": "2026-06-16T11:02:55Z"
},
{
"tag": "v0.0.90",
"kind": "patch",
"published_at": "2026-06-15T16:06:11Z"
},
{
"tag": "v0.0.89",
"kind": "patch",
"published_at": "2026-06-15T15:39:58Z"
},
{
"tag": "v0.0.88",
"kind": "patch",
"published_at": "2026-06-02T18:44:40Z"
},
{
"tag": "v0.0.87",
"kind": "patch",
"published_at": "2026-06-01T16:33:58Z"
},
{
"tag": "v0.0.86",
"kind": "patch",
"published_at": "2026-05-29T19:26:30Z"
},
{
"tag": "v0.0.85",
"kind": "patch",
"published_at": "2026-05-29T02:18:22Z"
},
{
"tag": "v0.0.84",
"kind": "patch",
"published_at": "2026-05-26T17:53:24Z"
},
{
"tag": "v0.0.83",
"kind": "patch",
"published_at": "2026-05-21T14:42:41Z"
},
{
"tag": "v0.0.82",
"kind": "patch",
"published_at": "2026-05-11T19:00:57Z"
},
{
"tag": "v0.0.81",
"kind": "patch",
"published_at": "2026-05-09T13:47:44Z"
},
{
"tag": "v0.0.80",
"kind": "patch",
"published_at": "2026-05-09T11:18:15Z"
},
{
"tag": "v0.0.79",
"kind": "patch",
"published_at": "2026-05-07T16:41:04Z"
},
{
"tag": "v0.0.78",
"kind": "patch",
"published_at": "2026-05-04T22:10:11Z"
},
{
"tag": "v0.0.77",
"kind": "patch",
"published_at": "2026-05-04T20:29:44Z"
},
{
"tag": "v0.0.76",
"kind": "patch",
"published_at": "2026-05-01T22:46:40Z"
},
{
"tag": "v0.0.75",
"kind": "patch",
"published_at": "2026-04-24T19:56:26Z"
},
{
"tag": "v0.0.74",
"kind": "patch",
"published_at": "2026-04-23T00:13:56Z"
},
{
"tag": "v0.0.73",
"kind": "patch",
"published_at": "2026-04-22T16:35:39Z"
},
{
"tag": "v0.0.72",
"kind": "patch",
"published_at": "2026-04-22T16:29:31Z"
},
{
"tag": "v0.0.71",
"kind": "patch",
"published_at": "2026-04-22T16:23:09Z"
},
{
"tag": "v0.0.70",
"kind": "patch",
"published_at": "2026-04-21T17:43:53Z"
},
{
"tag": "v0.0.69",
"kind": "patch",
"published_at": "2026-04-21T16:23:06Z"
},
{
"tag": "v0.0.68",
"kind": "patch",
"published_at": "2026-04-16T12:54:24Z"
},
{
"tag": "v0.0.67",
"kind": "patch",
"published_at": "2026-04-15T12:08:45Z"
},
{
"tag": "v0.0.66",
"kind": "patch",
"published_at": "2026-04-14T18:06:03Z"
},
{
"tag": "v0.0.65",
"kind": "patch",
"published_at": "2026-04-13T15:47:01Z"
},
{
"tag": "v0.0.64",
"kind": "patch",
"published_at": "2026-04-13T15:16:14Z"
},
{
"tag": "v0.0.63",
"kind": "patch",
"published_at": "2026-04-12T17:48:56Z"
},
{
"tag": "v0.0.62",
"kind": "patch",
"published_at": "2026-04-10T17:44:38Z"
},
{
"tag": "v0.0.61",
"kind": "patch",
"published_at": "2026-04-10T16:16:20Z"
},
{
"tag": "v0.0.60",
"kind": "patch",
"published_at": "2026-04-10T15:06:45Z"
},
{
"tag": "v0.0.59",
"kind": "patch",
"published_at": "2026-04-10T14:59:07Z"
},
{
"tag": "v0.0.58",
"kind": "patch",
"published_at": "2026-04-09T14:58:54Z"
},
{
"tag": "v0.0.57",
"kind": "patch",
"published_at": "2026-04-07T18:22:13Z"
},
{
"tag": "v0.0.56",
"kind": "patch",
"published_at": "2026-04-02T12:06:23Z"
},
{
"tag": "v0.0.55",
"kind": "patch",
"published_at": "2026-03-31T14:54:52Z"
},
{
"tag": "v0.0.54",
"kind": "patch",
"published_at": "2026-03-29T01:12:46Z"
},
{
"tag": "v0.0.53",
"kind": "patch",
"published_at": "2026-03-27T22:48:27Z"
},
{
"tag": "v0.0.52",
"kind": "patch",
"published_at": "2026-03-27T01:30:06Z"
},
{
"tag": "v0.0.51",
"kind": "patch",
"published_at": "2026-03-24T01:49:03Z"
},
{
"tag": "v0.0.50",
"kind": "patch",
"published_at": "2026-03-23T17:08:40Z"
},
{
"tag": "v0.0.49",
"kind": "patch",
"published_at": "2026-03-20T17:26:09Z"
},
{
"tag": "v0.0.48",
"kind": "patch",
"published_at": "2026-03-20T13:57:17Z"
},
{
"tag": "v0.0.47",
"kind": "patch",
"published_at": "2026-03-19T13:51:20Z"
},
{
"tag": "v0.0.46",
"kind": "patch",
"published_at": "2026-03-19T13:05:02Z"
},
{
"tag": "v0.0.45",
"kind": "patch",
"published_at": "2026-03-18T13:45:59Z"
},
{
"tag": "v0.0.44",
"kind": "patch",
"published_at": "2026-03-17T13:08:08Z"
},
{
"tag": "v0.0.43",
"kind": "patch",
"published_at": "2026-03-17T01:39:30Z"
},
{
"tag": "v0.0.42",
"kind": "patch",
"published_at": "2026-03-16T15:45:25Z"
},
{
"tag": "v0.0.41",
"kind": "patch",
"published_at": "2026-03-16T11:17:34Z"
},
{
"tag": "v0.0.40",
"kind": "patch",
"published_at": "2026-03-16T10:53:15Z"
},
{
"tag": "v0.0.39",
"kind": "patch",
"published_at": "2026-03-16T10:40:29Z"
},
{
"tag": "v0.0.38",
"kind": "patch",
"published_at": "2026-03-16T10:10:01Z"
},
{
"tag": "v0.0.37",
"kind": "patch",
"published_at": "2026-03-16T02:55:08Z"
},
{
"tag": "v0.0.36",
"kind": "patch",
"published_at": "2026-03-13T20:33:37Z"
},
{
"tag": "v0.0.35",
"kind": "patch",
"published_at": "2026-03-13T20:07:55Z"
},
{
"tag": "v0.0.34",
"kind": "patch",
"published_at": "2026-03-13T17:01:16Z"
},
{
"tag": "v0.0.33",
"kind": "patch",
"published_at": "2026-03-13T16:53:05Z"
},
{
"tag": "v0.0.32",
"kind": "patch",
"published_at": "2026-03-13T15:25:27Z"
},
{
"tag": "v0.0.31",
"kind": "patch",
"published_at": "2026-03-12T15:49:33Z"
},
{
"tag": "v0.0.30",
"kind": "patch",
"published_at": "2026-03-12T15:27:48Z"
},
{
"tag": "v0.0.29",
"kind": "patch",
"published_at": "2026-03-11T20:59:13Z"
},
{
"tag": "v0.0.28",
"kind": "patch",
"published_at": "2026-03-11T20:35:33Z"
},
{
"tag": "v0.0.27",
"kind": "patch",
"published_at": "2026-03-11T20:16:27Z"
},
{
"tag": "v0.0.26",
"kind": "patch",
"published_at": "2026-03-11T20:01:07Z"
},
{
"tag": "v0.0.25",
"kind": "patch",
"published_at": "2026-03-11T19:11:02Z"
},
{
"tag": "v0.0.24",
"kind": "patch",
"published_at": "2026-03-11T18:44:34Z"
},
{
"tag": "v0.0.23",
"kind": "patch",
"published_at": "2026-03-11T17:11:35Z"
},
{
"tag": "v0.0.22",
"kind": "patch",
"published_at": "2026-03-11T17:02:26Z"
},
{
"tag": "v0.0.21",
"kind": "patch",
"published_at": "2026-03-11T16:51:26Z"
},
{
"tag": "v0.0.20",
"kind": "patch",
"published_at": "2026-03-11T16:39:44Z"
},
{
"tag": "v0.0.19",
"kind": "patch",
"published_at": "2026-03-11T16:15:38Z"
},
{
"tag": "v0.0.18",
"kind": "patch",
"published_at": "2026-03-11T16:06:34Z"
},
{
"tag": "v0.0.17",
"kind": "patch",
"published_at": "2026-03-11T15:53:20Z"
},
{
"tag": "v0.0.16",
"kind": "patch",
"published_at": "2026-03-11T15:34:27Z"
},
{
"tag": "v0.0.15",
"kind": "patch",
"published_at": "2026-03-11T15:22:47Z"
},
{
"tag": "v0.0.14",
"kind": "patch",
"published_at": "2026-03-11T14:10:26Z"
},
{
"tag": "v0.0.13",
"kind": "patch",
"published_at": "2026-03-11T13:53:59Z"
},
{
"tag": "v0.0.12",
"kind": "patch",
"published_at": "2026-03-11T13:45:30Z"
},
{
"tag": "v0.0.11",
"kind": "patch",
"published_at": "2026-03-11T13:30:48Z"
},
{
"tag": "v0.0.5",
"kind": "patch",
"published_at": "2025-08-14T19:17:00Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2025-06-11T16:20:55Z"
},
{
"tag": "v0.0.3",
"kind": "patch",
"published_at": "2025-06-10T05:21:10Z"
},
{
"tag": "v0.0.2",
"kind": "patch",
"published_at": "2025-05-07T20:01:35Z"
},
{
"tag": "v0.0.1",
"kind": "patch",
"published_at": "2025-05-07T13:10:53Z"
}
],
"recent_commits": [
{
"oid": "5059a0fdd07b1359c4740fc856752fdee187d10b",
"body": "* fix: treat removal from a closed group as success, not an error\n\nRemoveFromGroup racing group teardown (servers-updated during tunnel\nshutdown) returned \"failed to remove <tag> from <group>: group is\nclosed\", which radiance escalated to a 500 and a full tunnel restart —\nthe every-3-minutes VPN dro\n[…]\nlantern-box release\nnow carries the full fix for getlantern/engineering#3693.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: treat removal from a closed group as success, not an error (#289)",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-07-17T22:42:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "177e4c30ccbad586f705bbf225479bc9f6457dd6",
"body": "Bumps github.com/getlantern/broflake c4d1516 → f2cacf69, pulling the\nconsumer-side unbounded fixes into lantern-box's unbounded outbound:\n\n- getlantern/broflake#371: engine teardown no longer leaks the bus\n observer, table routers, UI ticker, or a live PeerConnection per\n connect/disconnect cycle.\n[…]\ndiance\npicks it up by bumping lantern-box rather than overriding the transitive\nversion. Addresses getlantern/engineering#3698. Ran go mod tidy.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump broflake for unbounded leak/retry fixes (#288)",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-07-17T20:35:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "907fea9d990ad3d9eabea33a11dbc9b3c48bf5e6",
"body": "…t attr (#287)\n\n* fix(metrics): remove 1MB goodput floor, emit track as queryable point attr\n\nThe per-session goodput histogram (proxy.session.goodput) only recorded a\nsample for sessions that moved >= 1 MB. But the measured (client->proxy /\n\"receive\") direction averages ~22 KB/session in prod -- ~4\n[…]\nge a future change back to the resource-attr key.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(metrics): remove 1MB goodput floor + emit track as queryable poin…",
"author_name": "Ilya Yakelzon",
"author_login": "reflog",
"committed_at": "2026-07-17T11:44:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b2c28bbe1e4d5c73feae5291c137cdd10a392db0",
"body": "* feat(autoselect): tag user-traffic failures by kind\n\nTagHistory.UserFailures becomes []UserFailure{At, Kind} so consumers can\ntell apart the failure modes a route exhibits under real traffic:\n\n - dial: never established the connection\n - stall: a proven conn went silent for the idle window\n - \n[…]\nhrough the onFailure callback. A tolerant\nUserFailure.UnmarshalJSON keeps legacy bare-timestamp snapshots loadable,\ndecoding them as unknown.\n\n* sort userFailures when hydrating, update stale comments",
"is_bot": false,
"headline": "feat(autoselect): tag user-traffic failures by kind (#286)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-07-09T18:10:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f0a9e61c0d195d808aa0c1b2bf9761582262f873",
"body": "This reverts commit 8384c76bd4d9de6c825c745f577ace913d8e40d1.",
"is_bot": false,
"headline": "Revert \"Using water shared runtime (#281)\" (#285)",
"author_name": "Wendel Hime",
"author_login": "WendelHime",
"committed_at": "2026-07-06T18:41:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8b47d8c9d9b4133a9b1d4b46121af85c41bac47",
"body": "* fix(autoselect): demote proxies reset mid-stream\n\nnoteIO discarded every errored read/write, so a proxy that established\nfine but was reset mid-stream hit no demotion path: the dial-error path\nnever re-runs on an established conn, and Close stops the idle timer\nbefore fireStall can fire. Short URL\n[…]\neview\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(autoselect): demote proxies reset mid-stream (#284)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-07-02T19:29:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8384c76bd4d9de6c825c745f577ace913d8e40d1",
"body": "* water outbound: reuse one shared runtime across dials (compile once)\n\nBuild a single waterv1.SharedDialer per Outbound in loadConfig (compiles the\nWASM module once) and reuse it for every dial; each dial only instantiates a\nfresh guest instance, eliminating the per-dial CompileModule that leaked t\n[…]\n and would otherwise stall the cancellation\npath.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Using water shared runtime (#281)",
"author_name": "Wendel Hime",
"author_login": "WendelHime",
"committed_at": "2026-06-30T20:09:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "203e7ff8803b326fd14844237991e0436fc68b7a",
"body": "* meek: add a first-class meek server inbound\n\nMake meek a registered sing-box inbound so meek-servers can be provisioned\nthrough the track/bandit pipeline (one origin VM per route) instead of the\nhand-deployed standalone cmd/meek-server — and so a meek track has real routes\nto contribute bandit arm\n[…]\ner.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "meek: add a first-class meek server inbound (#283)",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-06-27T14:39:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d2f270e420bd50ced474016f947a3cf1cff8ad19",
"body": "protocol/meek: domain-fronted meek outbound (draft)",
"is_bot": false,
"headline": "Merge pull request #265 from getlantern/fisk/meek-outbound",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-06-26T14:59:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67937ccb61b91961db71524e9dad42924fc68df1",
"body": "…ing, smoke-test + deploy fixes)\n\n- client: bound each poll by ReadTimeout (context.WithTimeout) so a hung request\n can't block the poll loop forever when the caller's HTTPClient has no timeout.\n- server: read + size-check the request body BEFORE creating/dialing a session,\n so spammed unique X-Se\n[…]\nyments.\n- smoketest/README.md: label fenced code blocks (markdownlint).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "meek: address CodeRabbit review on #265 (timeouts, EOF/session harden…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-26T14:51:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "446085a20c6414a5594841e5c84823503ea000f8",
"body": "…lines, doc/default consistency)\n\nCorrectness:\n- server: when the upstream closes with nothing buffered, end the session (410\n Gone) instead of returning empty 200s forever; the client maps that 410 to\n io.EOF so a read-only caller tears down cleanly (new upstreamFinished() +\n errUpstreamClosed; \n[…]\nult\n (a default client could otherwise hit 413s on chunks 64-256 KiB).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "meek: address Copilot review on #265 (EOF propagation, net.Error dead…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-26T14:40:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73c35a3f20a5316e8f07558626bb67d260e027cb",
"body": "# Conflicts:\n#\tprotocol/register.go",
"is_bot": false,
"headline": "Merge remote-tracking branch 'origin/main' into fisk/meek-outbound",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-26T14:22:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "263f4b5a0036d32250b8eb4130ab72dcf8c87045",
"body": "meek: fix SOCKS5 CONNECT over the polling Conn (byte-wise reads desync it)",
"is_bot": false,
"headline": "Merge pull request #282 from getlantern/fisk/meek-socks5-fix",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-06-26T14:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1cbf6b20ab2242575486a04e10c17962d08ad3e",
"body": "…dening)\n\nclient.go: read one byte past the negotiated MaxBodyBytes and fail if the server's\nresponse exceeds it, rather than silently truncating (which would corrupt the\ntunneled byte stream) — mirrors the server's request-size check.\n\ndeploy.sh:\n- Require MEEK_HOST (no default) so an env-less run \n[…]\nirst-deploy convenience to operator-owned infra; set \"yes\" for strict).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "meek: address second Copilot round (over-cap response + deploy.sh har…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-26T14:04:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f3fbae8a206d9f19c96b4b264fc5fe1edc97a3fc",
"body": "…andshake test\n\n- Format the SOCKS5 CONNECT reply code and ATYP as hex (%#x), matching the\n auth-reply errors and RFC 1928's hex codes.\n- Validate the reply RSV byte is 0x00 (RFC 1928); reject otherwise.\n- Add a regression test for the fix: socks5ConnectSequenced over a Conn that\n returns one byte\n[…]\n no-auth\n method-select + CONNECT; plus a non-zero-RSV rejection test.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "meek: address Copilot review — hex reply codes, RSV check, bytewise h…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-26T13:43:05Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "06c6dc9b77608ee0fbbf609aee1142a7e71f3496",
"body": "The repo had no automation for updating the fronted meek-server, so the deploy\nwas manual + undocumented. deploy.sh builds linux/amd64 from the checkout, ships\nit, verifies the transfer by sha256, swaps it in atomically (timestamped\nbackup), restarts the service, and verifies /healthz — rolling back\n[…]\nnsible defaults; --dry-run previews the plan without touching the host.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "cmd/meek-server: add deploy.sh (build, ship, swap, verify, rollback)",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-25T16:24:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "92610ccbb699e4800a89e754d3cd9376f06ff5fc",
"body": "Two resilience/throughput improvements on top of the SOCKS5 fix.\n\nRetriable polls (for flaky networks, e.g. RU): each poll carries a monotonic\nX-Meek-Seq; the client holds the in-flight chunk until the poll succeeds and\nretries the same seq+body on failure (linear backoff, MaxPollRetries). The\nserve\n[…]\neam receives exactly 2 MiB (no dup)\nFull package tests pass with -race.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "meek: retriable polls (seq/ack) + larger negotiated poll body",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-25T16:12:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5e3ae35514b63bf544c236101b5995cb5344ba06",
"body": "…c it)\n\nDialContext used socks.ClientHandshake5, which reads the SOCKS5 replies\nbyte-at-a-time via varbin's stub ReadByte — that issues a 1-byte Read and\nreturns b[0] ignoring n. Over the meek polling Conn this desyncs the handshake:\nDialContext returns ~instantly with err=nil while microsocks actua\n[…]\nl HTTP 200 carried; ~226 KB/s direct download\n\nmeek package tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01H9beSsYGzUaBhRK5ULmtGr",
"is_bot": false,
"headline": "meek: fix SOCKS5 CONNECT over the polling Conn (byte-wise reads desyn…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-25T14:53:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b82a4f054e44013383343e15572b309bf44417f5",
"body": "* feat(autoselect): persist hard-demote state on TagHistory\n\nAdd a HardDemoted bool to the persisted TagHistory snapshot so consumers\ncan tell a hard-demoted member from a healthy one without re-deriving the\nfailure thresholds themselves.\n\nThe tier is the intrinsic one: toTagHistory classifies via d\n[…]\nilures\n\nInject the test failures in the recent past so toTagHistory's updatedAt\n(now) is >= every recorded outcome, matching real usage where a mutation\nand its persisted snapshot share one timestamp.",
"is_bot": false,
"headline": "feat(autoselect): persist hard-demote state on TagHistory (#280)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-06-18T20:56:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2233c6e53f98dc3742c68bf8de9f75e5e8a3efa2",
"body": "metrics: per-session download goodput histogram",
"is_bot": false,
"headline": "Merge pull request #277 from getlantern/fisk/bandit-experiment-goodput",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-06-18T15:10:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1bad5f9bb0c4f73f4edccf43d2032f397b70c7e0",
"body": "- Reword the goodput doc comments to \"received bytes per second of\n connection lifetime\" — the metric is bytes ÷ connection-lifetime\n seconds, and \"per connection second\" read ambiguously.\n- Change the proxy.session.goodput unit from \"By/s\" to \"bytes/s\" to\n match proxy.io's existing \"bytes\" spelling, keeping unit naming\n consistent within the metrics package (the metric has no consumers\n yet, so this is a free alignment).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Clarify goodput unit wording and align unit spelling",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-06-18T14:58:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "baac86fa3f7d57d4a716961c793097fe59b13094",
"body": "fix(samizdat): forward CloseWrite so TCP half-close isn't silently dropped",
"is_bot": false,
"headline": "Merge pull request #278 from getlantern/fisk/samizdat-half-close",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-06-17T19:26:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5dd7b6ddfa076eda28dcaf38bad9428a08e16e0c",
"body": "…opped\n\nwrapConn blocks Upstream() (to preserve H2 read-error normalization) but only\nforwarded NeedAdditionalReadDeadline — not CloseWrite. So sing-box's relay\n(bufio.CopyConn) couldn't detect half-close support on a samizdat conn and\nsilently downgraded every half-close to a full close, tearing do\n[…]\nthe underlying conn so the\nrelay reaches it, and add a regression test asserting wrapConn is detectable as\nN.WriteCloser and forwards the call.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(samizdat): forward CloseWrite so TCP half-close isn't silently dr…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-06-17T16:05:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1a0a0f007ff1eefb7035b5b250a41577f94cefdf",
"body": "- recordGoodput copies the attribute slice into a freshly-sized buffer before\n appending the direction tag, instead of appending onto AsSlice()'s result in\n place — removes any chance of sharing a backing array with a concurrent\n reporter (AsSlice reallocates today, but this is robust regardless).\n- The two goodput tests now defer server.Close() (matching the file's\n pattern) so an early failure can't leak the pipe end.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "metrics: address PR review on goodput histogram",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-06-16T21:55:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6a587500ca139f69d80be18c514d04447e35720c",
"body": "Adds proxy.session.goodput, a Float64Histogram (By/s) recorded once at\nconnection close = received bytes / connection seconds, for sessions that moved\n>= 1MB. Both TCP (conn.go) and UDP (packet_conn.go) accumulate per-connection\nreceived bytes and emit at Close; tagged with the receive direction plu\n[…]\ntransfer speed; both experiment arms are measured identically so it's a\nfair relative signal, and the >=1MB floor filters idle-dominated noise.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "metrics: per-session download goodput histogram",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-06-16T21:48:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1eb138dd4e9eda203a1d1c7e97c9703fd8eddbea",
"body": "* build: bump keepcurrent for fileSource pre-size fix\n\nPulls in getlantern/keepcurrent#10, which makes fileSource size-aware so\ngeo's startup InitFrom(FromFile) read of the cached ~75MB mmdb stops\nchurning through io.ReadAll's realloc staircase. Completes the memory fix\nstarted in #275 (which covere\n[…]\nurrent#10 merges (go get keepcurrent@<main> && go mod tidy).\n\n* build: re-pin keepcurrent to merged main (fileSource pre-size fix #10)\n\n---------\n\nCo-authored-by: Ilya Yakelzon <reflog@getlantern.org>",
"is_bot": false,
"headline": "build: bump keepcurrent for fileSource pre-size fix (follow-up) (#276)",
"author_name": "Ilya Yakelzon",
"author_login": "reflog",
"committed_at": "2026-06-16T12:12:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a0d41a581d6b9e9525cd2c6409c4faa7f1c8272c",
"body": "Pulls in getlantern/keepcurrent#9, which pre-sizes the reads used to sync\nthe MaxMind GeoLite2 mmdb (~75MB) through geo's FromTarGz(FromWeb(...))\npipeline. The old io.ReadAll grew its buffer by repeated reallocation,\nchurning through a chain of ever-larger backing arrays per sync; on 1GB\nVPS that transient spike dominated RSS and tripped the host-memory>85%\nalert. No code changes — keepcurrent stays an indirect dep.\n\nCo-authored-by: Ilya Yakelzon <reflog@getlantern.org>",
"is_bot": false,
"headline": "build: bump keepcurrent for sync memory fix (#275)",
"author_name": "Ilya Yakelzon",
"author_login": "reflog",
"committed_at": "2026-06-16T10:58:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "946ab9bf92fb15a3c19f562faeef634c173b6c33",
"body": null,
"is_bot": false,
"headline": "bump unbounded - remove go-nats (#274)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-06-15T16:01:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e7c81ae51bbd8f8d6f02723a87587505d5344962",
"body": "…e (#273)\n\n* perf: reuse autoselect scratch buffers, drop samizdat Network override\n\nrankLocked and splitHealthyForLocked now reuse per-MutableAutoSelect\nscratch slices (scratchPres, scratchRanked, scratchSplit) instead of\nallocating fresh slices on every call. Both run under the existing\ns.access l\n[…]\napter already\nreports (constructed with {tcp, udp}), so calls now delegate to the\nAdapter. Remove the obsolete zero-value test that only exercised the\ndeleted override.\n\n* clear scratch before reusing",
"is_bot": false,
"headline": "perf: reuse autoselect scratch buffers, drop samizdat Network overrid…",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-06-15T15:35:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a849abb3604b2bd4ec63f1ed515598d0180ec1a2",
"body": "disable password ssh auth",
"is_bot": false,
"headline": "Merge pull request #272 from getlantern/jay/86-pass-ssh",
"author_name": "Jay",
"author_login": "jay-418",
"committed_at": "2026-06-12T15:21:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f70bb00ad1e8bbcfb4da183a7dccadff3255f4bb",
"body": null,
"is_bot": false,
"headline": "validate after alteration",
"author_name": "Jay",
"author_login": "jay-418",
"committed_at": "2026-06-12T01:20:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d126ecce675d30709cf13b0b15d7965e30722a08",
"body": null,
"is_bot": false,
"headline": "disable password ssh auth",
"author_name": "Jay",
"author_login": "jay-418",
"committed_at": "2026-06-12T01:13:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f867417b50bc94d290209c4400cff941615da9e",
"body": "* group: add MutableAutoSelect outbound\n\nA client-side server-selection group that complements MutableURLTest by\ndistinguishing probe-URL health from user-traffic health. A passing probe\ncannot launder a failing outbound: userFailures only decrements on a\nsuccessful non-empty Read through the data-p\n[…]\n just shuffled. Both are configurable via SwitchToleranceMs and\nLadderCooldownSeconds. Rank demotion via user-failure counting still\nmoves traffic off bad peers while the ladder is gated.\n\n* run gofmt",
"is_bot": false,
"headline": "group: add MutableAutoSelect outbound (#266)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-06-02T18:39:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e9fc90d50301c3d414fcd571fe319ef2bf35800f",
"body": "* feat(protocol): derive supported protocols from registries\n\nCollect the supported protocol list from the inbound/outbound/endpoint\nregistries at init instead of hardcoding it, so the list reflects the\nactive build tags. Add an amnezia endpoint stub for builds without\nwith_wireguard that registers \n[…]\nhe\nregistry's CreateOptions. sing-box registers all protocols regardless of\nbuild tag, so collect the full registered set and remove wireguard,\namnezia, and tailscale when their build tags are absent.",
"is_bot": false,
"headline": "feat(protocol): derive supported protocols from registries (#271)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-06-01T16:28:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb02f7630cccb2fd5c021a155a24e0ae785e261a",
"body": null,
"is_bot": false,
"headline": "bump samizdat - use of closed network fix (#270)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-05-29T19:21:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fea9fb0cbfe5c67d2748cd42a8786fb3a1266c1e",
"body": "Wrap samizdat conns so torn-down HTTP/2 stream errors (e.g.\n\"http2: response body closed\", \"; CANCEL\") are mapped to\nnet.ErrClosed and treated as ordinary connection closes.\n\nWrap once at the stream layer: inbound handler conn, the TCP\noutbound conn, and the conn samizdatDialer hands the UoT client\n(covering both UoT dial and listen, since uot.Conn reads through\nit). The wrapper stays opaque (no Upstream) so reads can't be\nunwrapped past it, and forwards NeedAdditionalReadDeadline.",
"is_bot": false,
"headline": "feat(samizdat): normalize HTTP/2 read errors via WrapH2 (#269)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-05-29T02:13:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c81128dcdff03bcfdec74d0e7e853a3bccf300e",
"body": "…orrectness\n\n- outbound: DialContext now performs a SOCKS5 CONNECT to destination over\n the tunnel before returning the conn. sing-box treats meek as a terminal\n outbound and writes the application stream directly; without the CONNECT\n the SOCKS5 upstream (microsocks) reads the app's first bytes \n[…]\neBufBytes.\n\nTests: SOCKS5-connect-over-tunnel chain, oversized-body 413, small-cap\ndelivery (deadlock regression), and large-write backlog cap.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "meek: address second review pass — destination routing + buffer-cap c…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-26T22:13:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4a3324967bb413fbc5dcd2d69f01ac6d05888d09",
"body": "meek originated in Tor's PT framework but is architecturally distinct\nfrom Tor pluggable transports; the polling-over-HTTPS scheme here is\nthe one Psiphon and Lantern use in practice. Reword the package doc to\nsay meek-v1 rather than implying a Tor-PT lineage.",
"is_bot": false,
"headline": "meek: drop \"Tor pluggable transport\" framing in package doc",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-26T20:14:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe2ab1bc5e2371c0029ab973a27790b48b18a4a1",
"body": "outbound.go:\n- Reject non-https URL in NewOutbound (http:// would bypass the\n fronted TLS DialTLSContext and the cert pinning, leaking traffic).\n- Require each front to set verify_hostname or sni; without either,\n verifyChain runs with an empty DNSName and accepts any trusted cert\n (no real check\n[…]\nd instead of fixed /tmp paths\n(collision/symlink safety).\n\nTests: auth required (403 without/with wrong token), reserved headers\nnot overridable, NewOutbound rejects http scheme + identity-less front.",
"is_bot": false,
"headline": "meek: address PR review — security hardening + cleanups",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-26T20:07:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bcf2145b22da828e98d1e687deb9734c6d44dc89",
"body": "* fix: adding log id field to log messages\n\nCurrently there's no way to track which log messages belong to which request and that makes it difficult to track the errors from the beginning. With this ID field I hope to be able to identify all the flow from a log request, if it failed on the DNS part,\n[…]\nint32\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: adding log id field to log messages (#267)",
"author_name": "Wendel Hime",
"author_login": "WendelHime",
"committed_at": "2026-05-26T17:48:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c467035b6497e19c9f4e81c7d73ead47f45ae113",
"body": "readCond.Wait has no native timeout, so a Read parked there only ever\nwoke on data arrival, close, or a fresh SetReadDeadline call —\nnever on the deadline elapsing in real time. Callers setting a\nfuture deadline and waiting for it would hang indefinitely.\n\nAdd a time.AfterFunc that broadcasts on rea\n[…]\neach SetReadDeadline call (re-arming or\nclearing) and on Close. Zero t clears without arming.\n\nTest asserts a SetReadDeadline(now+100ms) followed by a blocking\nRead returns errReadDeadline in 50ms–1s.",
"is_bot": false,
"headline": "protocol/meek: SetReadDeadline now unblocks a parked Read",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-24T15:51:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "13865421899803d419c9d6ebb3c0f95a4eef2008",
"body": "Captures the verified reference stack (Akamai DSA → Caddy → meek-server\n→ microsocks → public internet) and a reproducible test that exercises\nthe full chain: SOCKS5 handshake + CONNECT + HTTP GET, returning the\norigin IP httpbin observed (the Linode's public IP, confirming the\nrequest actually exits via the proxy).\n\nTest currently passes:\n ✅ End-to-end SUCCESS: \"origin\": \"139.162.181.47\"",
"is_bot": false,
"headline": "cmd/meek-server: add end-to-end SOCKS5 smoke test + deployment notes",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-23T21:46:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c34e923194e8ea8e1ee06a4917b7f65eddec586",
"body": "* fix: only locking water dial when it's not ready\n\nCurrently the mutex is being locked whenever it's dialing and if another request happens in parallel that could be locked. This is basically bringing a conflict with URL tests that need to dial but the dialer is already being used and locked, makin\n[…]\n+Copilot@users.noreply.github.com>\n\n* fix: adding suggestions\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "fix: stabilize WATER outbound in memory-constrained environments (#261)",
"author_name": "Wendel Hime",
"author_login": "WendelHime",
"committed_at": "2026-05-21T14:37:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5d1682bd60aeb1117c92008cc865d419e5460e92",
"body": "Adds the server side of the meek-v1 transport: a plain-HTTP\nhttp.Handler that terminates the meek protocol and forwards each\nsession's bytes to a configured TCP upstream. Deploys behind a CDN\n(Akamai DSA, CloudFront alt-domain) that handles TLS termination.\n\nProtocol matches the client in this same \n[…]\nnd on\nlocalhost:1080 so the meek tunnel terminates into the existing\nproxy backend. CDN-side fronting handles TLS termination plus the\ndomain-fronting routing (inner Host = the server's CDN hostname).",
"is_bot": false,
"headline": "protocol/meek + cmd/meek-server: domain-fronted server",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-19T14:20:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1b4abb223dee88b1f72ad347d3a75e27aab0290",
"body": "Adds a first-class meek-style transport (Tor pluggable-transport v1\nwire format): chunked TCP-over-HTTPS, session-keyed by a per-Conn\nrandom ID in X-Session-Id, polling-based half-duplex.\n\nThe intended deployment is a separate meek server on a non-API\ndomain (e.g. running on a Linode VPS), reachable\n[…]\ns writes,\nand config validation. Front-list is fed externally — radiance's\nfronted/scanner produces the working pool per-(ASN, location, time)\nand supplies it to MeekOutboundOptions.Fronts via config.",
"is_bot": false,
"headline": "protocol/meek: domain-fronted meek outbound",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-19T12:42:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9f277ec9cc203276ce11291a24f5fe62e5fed9b8",
"body": "* group: retry across outbounds on dial/listen failure\n\nDialContext and ListenPacket now try up to maxDialRetries distinct\noutbounds before giving up, returning ErrAllOutboundsFailed so callers\ncan trigger recovery.\n\n* address Copilot review on dial/listen retry\n\n- Re-evaluate realTag post-attempt f\n[…]\nundAttempts since it gates both Dial\n and Listen paths.\n- Move shared mockOutbound / mockOutboundManager to mock_outbound_test.go.\n- Make retry tests table-driven across DialContext and ListenPacket.",
"is_bot": false,
"headline": "group: retry across outbounds on dial/listen failure (#258)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-05-11T18:55:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "845325bd850af6dc963477a55ababb18a590a90e",
"body": "otelcol: ship cloud-init journald to SigNoz",
"is_bot": false,
"headline": "Merge pull request #260 from getlantern/fisk/otelcol-journald",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-11T15:09:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c497fc88435f867afc5abf936c3d9b24ec3a79f0",
"body": "Two PR review fixes:\n\n1. The image-verification block at the end of provision.sh enumerates\n the drop-in paths the packer image is supposed to ship. The new\n journald.conf drop-in (added in the first commit of this PR) was\n missing from that list, so a regression that dropped it during a\n fu\n[…]\ned\n on PATH. Catches malformed YAML, unknown receivers/exporters, or\n missing pipeline references at image build time instead of after\n the bad image rolls out to every new bandit-VPS provision.",
"is_bot": false,
"headline": "review: add journald.conf to verify list + actual otelcol validate",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-11T14:21:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9087ba8bf4ab4e3fa6be817d9c66dc71eea70c3c",
"body": "cloud-init's diagnostic logging — the `logger -t cloud-init \"step: …\"`\ncheckpoints and the `set -e` ERR trap that logs `halted at line N\n(rc=X): <cmd>` — writes to journald. Before this commit, otelcol-contrib\non the packer image only scraped /var/log/lantern-box/*.log and host\nmetrics; nothing ever\n[…]\nurnal records.\n\nNo code change in lantern-box itself. After merge, cut a new release\nand rebuild the packer image so new bandit-VPS provisions pick up the\nfix; existing fleet stays as-is until rolled.",
"is_bot": false,
"headline": "otelcol: ship cloud-init journald to SigNoz",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-11T12:42:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e93d8f372d2bf36faa75543c3fb06f7357c33324",
"body": "e2e: live-machine Unbounded test on a DO droplet",
"is_bot": false,
"headline": "Merge pull request #242 from getlantern/fisk/unbounded-live-e2e",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-09T13:43:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a57510f6bc8c7e335aee377c59ba3771fa3ba741",
"body": "Today's run (#25599661331) failed Reflex + Unbounded with DNS lookup\ntimeouts on the droplet, *after* the earlier ALGeneva/Samizdat/WATER\nservers had successfully resolved example.com against the droplet's\ndefault systemd-resolved → DO infrastructure path. The artifact\ndownload confirms the bisect:\n\n[…]\n mid-test, where it's harder to\ndiagnose. options timeout:2 attempts:2 keeps lookups snappy if either\nresolver is briefly unhappy.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "e2e: pin DNS to public resolvers on the test droplet",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-09T12:37:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bba07a5426f210ce6c4771e0c2457f6ed1d8a647",
"body": "packer: move to Reflog's Option B — lantern-box installs via cloud-init",
"is_bot": false,
"headline": "Merge pull request #248 from getlantern/fisk/packer-option-b",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-09T11:17:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d9c2bbbbddebfad03d8acafd6de57fe48e900e5",
"body": "The systemctl daemon-reload before the OTel section ran before any\nservice unit files or drop-ins existed, making it a no-op. The second\ndaemon-reload after the drop-ins are written already covers them.\nRemoving the call (and its misleading comment) per reviewer feedback on\nPR #248.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "packer: drop redundant first daemon-reload in provision.sh",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-05-09T11:16:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ad58655fa2557e984ac326bd21cf4e5ecf2fb80b",
"body": "systemd: load OTel env from /etc/lantern-box/otel.env",
"is_bot": false,
"headline": "Merge pull request #259 from getlantern/fisk/systemd-env-otel",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-09T11:13:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "915b0112058fff9ae79f75df1ce7f6a80d8982f7",
"body": "Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Potential fix for pull request finding",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-09T11:13:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d7359e5c14c0b6a299d4e0a640ff47d0f0145ca6",
"body": "… fisk/unbounded-live-e2e\n\n# Conflicts:\n#\tgo.mod\n#\tgo.sum",
"is_bot": false,
"headline": "Merge branch 'main' of https://github.com/getlantern/lantern-box into…",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-09T11:09:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "624a2cae69303ac21fdc9e858b9bde95a7ebba7c",
"body": "The lantern-cloud bandit VPS cloud-init script writes\n/etc/lantern-box/otel.env with OTEL_EXPORTER_OTLP_ENDPOINT and\nOTEL_RESOURCE_ATTRIBUTES (service.name=vps-proxy, route.id=...,\ndeployment.environment=..., etc.) before starting the lantern-box\nservice. But the .deb-installed unit file had no `Env\n[…]\nx. Cut a\nnew release after merge so BanditVPSReleasePollerWorker picks it up\nand new bandit-VPS provisions install the fixed unit.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "systemd: load OTel env from /etc/lantern-box/otel.env",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-09T10:58:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e11b77b3886646e49076a186f0fd8692342da931",
"body": "* group: reselect immediately after dial/listen failure\n\nmutableurltest's DialContext/ListenPacket already deleted the failing\noutbound's URL-test history on error, but never recomputed selection.\nselectedOutboundTCP/UDP kept pointing at the dead outbound, so every\nsubsequent dial hit the same failu\n[…]\n dial lands on a healthy outbound.\n\nTighten pickBestOutbound's no-history fallback to skip current, so the\njust-failed outbound isn't re-picked when no candidate has history.\n\n* add tests, use realTag",
"is_bot": false,
"headline": "group: reselect immediately after dial/listen failure (#254)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-05-07T16:36:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2dd74cf6111b46387a4a192e151cd882469a5eac",
"body": "…lass\n\nbump broflake for clientcore err_class instrumentation",
"is_bot": false,
"headline": "Merge pull request #253 from getlantern/fisk/bump-broflake-quic-err-c…",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-04T22:05:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "536f59006e82c90b169b52545c9f4fca6abc41ce",
"body": "Picks up getlantern/unbounded#360 (clientcore: classify QUIC connection\nerrors for triage) plus getlantern/unbounded#359 (egress: integration\ntest for connection migration) — the latter is test-only and doesn't\naffect runtime, but the version bump is the same.\n\nThe instrumentation that lands here ad\n[…]\n migration\nfailures Nelson reported.\n\n`go mod tidy` clean; the existing pre-existing vet warning in\nprotocol/amnezia is unchanged.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "bump broflake for clientcore err_class instrumentation",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-04T22:00:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f6ed7ec1aed41dc71f10c09203b0f15fee294dd2",
"body": "…atchdog\n\nunbounded: passive dial watchdog for slow-peer detection",
"is_bot": false,
"headline": "Merge pull request #252 from getlantern/fisk/unbounded-passive-dial-w…",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-04T20:25:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "996189370f8833cd0e9bdc3b06e45f1df7d447bd",
"body": "Four findings, all valid:\n\n- Replace the slice + slide window with a true ring buffer (fixed-size\n array + write index + filled flag). The previous `samples = samples[1:]`\n approach steadily ate the underlying array's capacity and forced a\n reallocation every ~window records; record() runs on eve\n[…]\nhas always used the production thresholds; the\n explanation now matches the behavior.\n\nTests still all pass under the same flags.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "unbounded: address Copilot review on watchdog passive observer",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-04T20:19:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "626ba4df5de16a97433009b9a10d429a6d3cb0ee",
"body": "Adds a per-Outbound dialWatchdog that observes successful dial elapsed\ntimes, classifies the current pairing's health using region-agnostic\nheuristics, and emits structured warnings when a pairing looks\npathologically slow.\n\nThe trip rule fires when the rolling 10-dial window has zero dials under\n1s\n[…]\n\nTests cover: full-window slow trip, fast-dial-in-window guard, medium-\nband non-trip, re-arm + second trip, and the lifetime cap.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "unbounded: passive dial watchdog for slow-peer detection",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-04T20:11:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7ff00fc81a9605a37073c29f205863b11cfbb79e",
"body": "Bump broflake to ce5f75a (unbounded slog sweep)",
"is_bot": false,
"headline": "Merge pull request #251 from getlantern/fisk/bump-broflake-slog-sweep",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-05-01T22:41:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8557a6e46308cf0c7c548e6e8f1aa23474216d0f",
"body": "Picks up PR #357 in getlantern/unbounded:\n- common.Debugf/Debug call sites replaced with slog.Debug\n- DANGER banners in standalone egress / proxy commands moved to slog.Warn\n- Standalone-binary main() functions now configure slog at LevelDebug to\n preserve the prior always-on stderr behavior of common.Debugf/Debug\n\nNo API changes — purely a logging-layer migration. lantern-box build is\nclean against the new pseudoversion.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump broflake to ce5f75a (slog sweep)",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-05-01T22:15:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b5d1cbaafe6fdc10b424c3c7ee94638d5083f9dc",
"body": "reflex: lower default silence timeout to 2s ± 600ms",
"is_bot": false,
"headline": "Merge pull request #250 from getlantern/fix/reflex-silence-timeout-2s",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-24T19:50:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a8bc017b2ebebaee4b09c3904d51b6ac1879f5f",
"body": "The implementation in silence.go:62-80 picks a uniform random offset\nin [-jitter, +jitter], so the actual silence window ranges from\nSilenceTimeout - SilenceJitter to SilenceTimeout + SilenceJitter. The\nold comment said \"maximum random duration added to SilenceTimeout\",\nwhich implied a one-sided distribution and didn't reflect the\nstrictly-less-than constraint the inbound enforces.\n\nAddresses Copilot review on #250.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "reflex: doc SilenceJitter as symmetric, not one-sided",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-04-24T19:46:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b839989e6ad61bfd356dcd448ef85cb761baa954",
"body": "The silence window is the server-side delay before reflex sends the\nClientHello that signals a legit Lantern client. 5s ± 2s meant the\nworst-case wait was 7s; 2s ± 600ms caps it at 2.6s. This trades a\nslightly narrower probe-detection window (2.6s still comfortably\nexceeds a typical active-probe TCP\n[…]\ndated in tandem).\n\nAlso updated the doc comments in option/reflex.go so \"Typical value\"\nand \"Defaults to\" reflect the new numbers.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "reflex: lower default silence timeout to 2s ± 600ms",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-04-24T19:38:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3dfcbe38e38365e06c64d45cad71d0439fbb54b6",
"body": "- provision.sh: stale comment said the packer image still contributes\n an \"auto-update fallback cron\" — the cron was removed in an earlier\n commit. Drop the phrase.\n- provision.sh: add wireguard-tools to match the Dockerfile + README\n package list (per the \"keep in sync with Dockerfile\" comment a\n[…]\nb.event.inputs.*` is strictly more defensive on a push\n trigger without any downside (this workflow doesn't use\n workflow_call).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "packer: address Copilot review on Option B cleanup",
"author_name": "Adam Fisk",
"author_login": null,
"committed_at": "2026-04-23T19:00:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ce0e49d8f01e211507b269c085f7d9067ed80f1e",
"body": null,
"is_bot": false,
"headline": "storage urltest history storage under proper key (#249)",
"author_name": "garmr-ulfr",
"author_login": "garmr-ulfr",
"committed_at": "2026-04-23T00:09:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b42ea8a5a87a04cf25a63ca4b324e648624e4a2",
"body": "…ery release\n\nFollow-ups to the Option B strip (91b027f). Both requested by Reflog in\nthe same thread ts=1776197690.140869 in #infrastructure-and-services.\n\nCron removal:\n The /etc/cron.d/lantern-box-update + /usr/local/bin/lantern-box-update\n cron was the thing that was silently failing 266 times/h\n[…]\nebuild, no 36-region OCI fan-out, no\ncross-region image push. Reflog's 30 minutes of CI per release + the\nAPI/traffic cost goes away. Packer images rebuild only when the image\nitself actually changes.",
"is_bot": false,
"headline": "packer: remove lantern-box-update cron + stop rebuilding images on ev…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-22T19:01:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "91b027f28624dd31769683436fbb8af463592504",
"body": "Reflog in #infrastructure-and-services thread ts=1776197690.140869\n(2026-04-16) noted that rebuilding the full N-provider × M-region packer\nimage matrix on every lantern-box release is expensive (30min of CI per\nrelease, traffic/API usage from pushing to every region), and proposed\nmoving the lanter\n[…]\nill fail. Revert path: re-merge\nthis commit's reverse diff.\n\nVERSION env var is kept because the image name still includes it as a\nlabel; the script itself no longer uses it, comment updated to match.",
"is_bot": false,
"headline": "packer: strip pre-baked lantern-box install (Reflog's Option B)",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-22T18:55:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "afa471a475ecb23f6f7b4c8cbb9bbe8bbd89bf98",
"body": "packer: drop DigitalOcean builder",
"is_bot": false,
"headline": "Merge pull request #247 from getlantern/fisk/packer-drop-digitalocean",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-22T16:31:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "129e02d2a338696b48f3a0704d2359bea2326263",
"body": "We're not actively using DigitalOcean in the bandit fleet — all current\ntraffic flows through OCI, Linode, and Alicloud. The DO builder has also\nbeen failing every release with \"Size is not available in this region\"\nfor `s-1vcpu-1gb` in the configured region, failing the whole\nbuild-images workflow \n[…]\n deploy/packer/README.md (single-provider example, env var table, deploy example)\n - deploy/packer/cloud-init.yaml.example (example provider field)\n\nIf DO support is needed again, revert this commit.",
"is_bot": false,
"headline": "packer: drop DigitalOcean builder",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-22T16:27:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "94fad1a0b8c5966c86cb789be97dce8b2150621d",
"body": "deps: bump sing-box-minimal to v1.12.22-lantern",
"is_bot": false,
"headline": "Merge pull request #246 from getlantern/fisk/bump-sbm-v1.12.22",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-22T16:24:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "725b12b1beae09af1e93d0b64231a24e235cf1ba",
"body": "Picks up getlantern/sing-box-minimal#41: seed NetworkManager's interface\nlist synchronously from the platform at startup, fixing the 'no available\nnetwork interface' flood after Android VPN stop→start cycles (Freshdesk\n#173507).",
"is_bot": false,
"headline": "deps: bump sing-box-minimal to v1.12.22-lantern",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-22T16:20:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7816bb8d9a77da4993247dfc9956de32ec600827",
"body": "deps: bump keepcurrent to pick up FromTarGz extraction fix",
"is_bot": false,
"headline": "Merge pull request #245 from getlantern/fisk/bump-keepcurrent-targz-fix",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-22T16:18:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d7c718b48289028458d8303aab082ae4a3043c15",
"body": "Bumps keepcurrent from 017d542 (2026-03-04) to 54a4d9a (2026-04-22).\n\nPulls in getlantern/keepcurrent#7, which fixes two back-to-back bugs in\nFromTarGz introduced by the mholt/archiver → mholt/archives migration:\n\n 1. archives.CompressedArchive was constructed with Archival set instead\n of Extr\n[…]\na point with\ngeo.country.iso_code=\"\" and the dashboard's country filter matched zero.\nOnce this lands and the packer image is rebuilt + rolled out, country\ntagging should start working on fresh VPSes.",
"is_bot": false,
"headline": "deps: bump keepcurrent to pick up FromTarGz extraction fix",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-22T16:14:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "117638dec3312f825dc3cea5a522b9ca0219e12e",
"body": "deps: bump broflake to main + quic-go fork to v0.59.0-unbounded",
"is_bot": false,
"headline": "Merge pull request #244 from getlantern/fisk/bump-broflake-v059",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-21T17:39:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ed95209992262aae50338a786b08c7d25ef03fc",
"body": "Per Copilot feedback — explain inline why the qpack replace exists\n(sing-box-minimal/sagernet quic-go http3 compat), what specifically\nbreaks without it (NewDecoder/DecodeFull API gone in v0.6.0), and when\nthe replace can be removed (sagernet/quic-go bump to v0.59.0-sing-box-\nmod.4 or later).",
"is_bot": false,
"headline": "review: document why qpack is pinned to v0.5.1",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-21T17:33:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8535337358b64573fb589fe67f6913207ea02fca",
"body": "…nded\n\nPicks up the content of unbounded PR #354 + #350 + #353 + #241 that is\nnow on broflake's main:\n- covert-dtls randomization (for the widget DTLS ClientHello)\n- data-plane byte counters (BROFLAKE_STATS env-gated)\n- QUIC listener spin-loop fix\n- pion/webrtc v4.2.11 migration\n- quic-go v0.59.0 (w\n[…]\nnd-to-end via desktop Lantern connecting through\nwidget+egress: WebRTC datachannel opens, QUIC handshake completes,\ntraffic flows.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump broflake to main (caea079) + quic-go fork to v0.59.0-unbou…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-21T17:27:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "48ee1e78a40bdfd3779674b24e53ff50b0867557",
"body": "Unbounded consumer outbound (fresh implementation)",
"is_bot": false,
"headline": "Merge pull request #241 from getlantern/fisk/unbounded-outbound-v2",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-21T16:18:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f659137ad504e8690b3c6a59e234d7db6ac7d482",
"body": "Addresses Copilot feedback on tls_test.go: the helper was named 'CA' but\nthe template had only SerialNumber set — no IsCA, BasicConstraintsValid,\nKeyUsageCertSign, NotBefore/NotAfter, or Subject. That worked for the\ncurrent tests (they just feed the PEM to x509.CertPool.AppendCertsFromPEM,\nwhich doe\n[…]\nerified peer chains against a ClientCAs pool. Populate the template with\nCA-appropriate fields so the helper lives up to its name.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "review: make newTestCA an actual CA cert",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-21T13:28:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7c3222668af75eb366df74f7eda6a712879cae76",
"body": "The e2e build was failing with:\n github.com/sagernet/quic-go/http3/client.go:102:31: too many arguments\n in call to qpack.NewDecoder\n github.com/sagernet/quic-go/http3/http_stream.go:233:24:\n s.decoder.DecodeFull undefined\n\nRoot cause: broflake pulled in quic-go/quic-go v0.59.0, which depend\n[…]\nng\nsagernet/quic-go v0.59.0-sing-box-mod.4 (qpack v0.6.0 API) and drop\nthis replace in favour of the fork's v0.59.0-unbounded tag.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: pin quic-go to Lantern fork v0.56.1-unbounded",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-21T11:56:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e003a8ac16a3108863a70041c74b201126a39941",
"body": "…binding\n\nunbounded: bind pion ICE sockets to physical interface + lifecycle logs",
"is_bot": false,
"headline": "Merge pull request #243 from getlantern/fisk/unbounded-ice-interface-…",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-20T23:36:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c57388e1a3fbe92609c05220925294efcc2995b5",
"body": "… comment\n\n- Downgrade ListenPacket start/ok logs from Info to Debug (matching\n DialContext's pattern). UDP-heavy flows were producing excessive\n Info-level lines in normal operation.\n- Store destination.String() once as `dest` in both DialContext\n (TCP+UDP) and ListenPacket, reuse for all log fi\n[…]\nl (gating would reintroduce the \"NAT failure,\n aborting!\" regression this override exists to prevent); the comment\n now says so.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "review: ListenPacket to Debug, dedup destination.String(), fix net.go…",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-20T23:35:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "15d1327a1579034262f319022029b4e544a66782",
"body": "Two related changes that showed up while debugging end-to-end Unbounded\nunder TUN:\n\n1. Override rtcNet.ListenUDP so pion's ICE agent (a.net.ListenUDP, via\n pion/ice/v4 gather.go's listenUDPInPortRange) doesn't fall through\n to the embedded *stdnet.Net. Without the override, ICE host-\n candidat\n[…]\ne\n \"when did Start complete\" + \"which dial failed how quickly\" data\n that was missing during the 2026-04-20 debugging session.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "unbounded: bind pion ICE sockets to physical interface",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-20T23:21:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cfb46708ff6789ebd27b8ea71a2a84a00bbc67e7",
"body": "fisk/pion-v4.2 and fisk/covert-dtls were siblings off main, so the\nprevious pin to pion-v4.2 left the live e2e blind to the covert-dtls\nClientHello hooks (the whole reason for the rig in the first place).\nThe new branch merges both so the rig's widget now emits randomized /\nmimicked browser ClientHe\n[…]\n would see in production; the live e2e now\nactually validates that the widget-side DTLS handshake succeeds through\nthat hook path.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: repin broflake to fisk/pion-v4.2-covert-dtls",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T23:59:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e68c3828190f2cfdf063fb6ab7936032dbe5c671",
"body": "Stacked PRs against feature branches (the Unbounded outbound stack\nbeing the current motivator) should get live-machine coverage before\nmerging into main. The path filter still gates the workflow so doc-only\nPRs don't burn droplets.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "e2e: run on every PR, not just those targeting main",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T23:48:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b30043e256d131dad8f2cccdacbb64e753d6f8a8",
"body": "…hatches\n\n- waitForFreddie now log.Fatalfs when freddie doesn't come up within\n the timeout. Previously it logged and returned, letting the widget\n spin against a dead freddie and only surfacing the problem when the\n client test finally timed out.\n- All three InsecureSkipVerify sites (widget HTTP\n[…]\non't flag them\n and reviewers immediately see they're intentional test/dev escape\n hatches, not general-purpose TLS relaxations.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "address PR review: fail fast on freddie timeout, annotate TLS escape …",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T23:46:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6239c8a840e8d2c968b126bb1c4a3fa9af343655",
"body": "Adds a Go binary at test/e2e/unbounded-rig/ that runs freddie + egress +\na native broflake widget in one process, plus a new Test Unbounded step\nin .github/workflows/e2e.yaml that:\n\n 1. Builds the rig\n 2. Uploads it to the existing throwaway DigitalOcean droplet\n 3. Starts it alongside the four s\n[…]\nsing-box-minimal's sagernet/quic-go fork (qpack API break) that needs\nto be resolved separately.\n\nRefs getlantern/engineering#3233\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "e2e: live-machine test for Unbounded on a DO droplet",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T23:35:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "19e66fef6ea8acd3a5cab964f18f62ff47f3fdd6",
"body": "Follow-up to the pion bump. broflake PR #352 rebased our quic-go fork\nonto upstream v0.59.0 (our sole patch — connection ID limit — still\napplies cleanly). TestUnboundedE2E passes.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump broflake to pick up quic-go v0.59.0",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T23:01:53Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e97307f964e3717db5f9a0ed662df13eca2f22a8",
"body": "Carries the pion/webrtc v4.2.x bump from broflake through to lantern-box.\nUpdates protocol/unbounded/net.go's rtcNet adapter to satisfy the new\npion/transport/v4.Net interface (CreateDialer now returns\ntransport/v4.Dialer).\n\nUnlocks DTLS 1.3 handshake work-in-progress in pion/dtls v3.1.2 and\nSCTP RA\n[…]\n2E passes end-to-end\nwith the new version, so consumer <-> widget DTLS 1.2 handshakes still\nnegotiate cleanly on the bumped stack.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump broflake (pion/webrtc v4.2.11, transport v4), migrate rtcNet",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T22:44:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ae4efcc1a7556f3341e4e043f0b5e0e5b75ebcf",
"body": "upstreamHits was written from the httptest handler goroutine and read\nfrom the test goroutine without synchronization — race under go test\n-race. Swapped to atomic.Int64.\n\nNote: running the full e2e under -race still surfaces a pre-existing\nrace inside broflake's STUN NAT-discovery path (enobufs/go-nats), which\nis out of scope here. Our local race is fixed.",
"is_bot": false,
"headline": "address Copilot review: atomic upstreamHits",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T21:25:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a2e97f5e8cab52ff2c981777b22cd27cc53037f",
"body": "- tls.go: self-signed cert template now carries non-zero NotBefore /\n NotAfter (24h window, 1-min skew tolerance), KeyUsage\n (DigitalSignature | KeyEncipherment), ExtKeyUsage (ServerAuth +\n ClientAuth, since Unbounded flips TLS roles), BasicConstraintsValid,\n and a 128-bit random serial. Previou\n[…]\nere it checked a hand-copied snapshot, so couldn't catch\n regressions) to a new protocol_test package that calls the real\n protocol.SupportedProtocols(). This actually validates what it\n claims to.",
"is_bot": false,
"headline": "address Copilot review on #241",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T21:22:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6242292139bc89c40644fe82a5675df491bb804e",
"body": "unbounded#348 landed on upstream main. broflake bumped from\nv0.0.0-20260215213912-5f68e35de272 (Feb 15) to\nv0.0.0-20260417205057-3d93ed3e39da (today's main), which includes the\negress NewListener panic fix and the DefaultServeMux-ww follow-up.\n\nCan now restore proper cleanup in the e2e test: ctx.WithCancel is back,\nand t.Cleanup closes the egress listener. Previously both of those\npropagated a goroutine panic into the test runner. Verified with\n-count=3: 3/3 clean shutdowns, ~5.6s each.",
"is_bot": false,
"headline": "bump broflake past the egress clean-shutdown fix",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T21:15:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88e57fbe98ebe5697d92f23993c645449bb36602",
"body": "Spins up the full Unbounded stack in the test process (freddie signaling,\negress SOCKS5+QUIC-over-WebSocket, a broflake widget producer, and a\nsing-box consumer with our Unbounded outbound) and exercises a complete\nHTTP proxy round-trip end-to-end. Mirrors the stack layout described in\nthe broflake \n[…]\n to\nthe test runner. Workaround: use a background context and let OS-level\ncleanup at test-binary exit reclaim the listener. Inline comment in the\ntest notes the bug so future readers aren't confused.",
"is_bot": false,
"headline": "add in-process e2e test for unbounded outbound",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T20:33:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f95ee9e2e567e568fb129fdd6b4874f4c60619a8",
"body": "Fresh implementation of the Unbounded consumer-side outbound, replacing the\napproach in #76. Targets the radiance refactor-branch world where everything\nruns in the VPN tunnel process, which simplifies the signaling-path problem\nthat bogged down the earlier draft.\n\nDesign notes\n\n1. Options are JSON-\n[…]\ntation-of-input-pool, post-construction mutation isolation\n- signaling transport preference (injected > fallback) — this is the\n regression that would silently route signaling back through the tunnel",
"is_bot": false,
"headline": "add unbounded outbound for censored consumers",
"author_name": "Adam Fisk",
"author_login": "myleshorton",
"committed_at": "2026-04-17T20:17:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "939fa986a302b4a443f9da4e9ed25168f4c5c6d7",
"body": "* fix: include datacap in packer image (optionally)\n\n* addressed code review\n\n* address code review: harden CI build and datacap provisioning\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: include datacap in packer image (optionally) (#240)",
"author_name": "Ilya Yakelzon",
"author_login": "reflog",
"committed_at": "2026-04-16T12:49:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "88fe3faaee25a9d453e22237388471ee636d29c9",
"body": "fix: avoid 20s DNS timeout blocking UDP packet connections",
"is_bot": false,
"headline": "Merge pull request #239 from getlantern/fix/packet-conn-dns-timeout",
"author_name": "Myles Horton",
"author_login": "myleshorton",
"committed_at": "2026-04-15T12:04:18Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 99,
"commits_last_year": 606,
"latest_release_at": "2026-07-17T22:46:43Z",
"latest_release_tag": "v0.0.104",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 46,
"days_since_latest_release": 4,
"mean_days_between_releases": 3.2
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 25,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/getlantern/lantern-box",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/getlantern/lantern-box",
"is_deprecated": false,
"latest_version": "v0.0.104",
"repository_url": "https://github.com/getlantern/lantern-box",
"versions_count": 104,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-17T22:42:03Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4
}
]
},
"popularity": {
"forks": 3,
"stars": 10,
"watchers": 5,
"fork_history": {
"days": [
{
"date": "2026-02-06",
"count": 1
},
{
"date": "2026-06-02",
"count": 1
},
{
"date": "2026-06-14",
"count": 1
}
],
"complete": true,
"collected": 3,
"total_forks": 3
},
"star_history": null,
"open_issues_and_prs": 15
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"cmd/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 50657,
"source_files_sampled": 120,
"oversized_source_files": 0,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 98
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.48.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 10,
"advisory_ids": [
"GHSA-45gg-vh54-h5m9",
"GHSA-5cgq-3rg8-m6cv",
"GHSA-78mq-xcr3-xm33",
"GHSA-89gr-r52h-f8rx",
"GHSA-9m57-25v3-79x9",
"GHSA-f5wc-c3c7-36mc",
"GHSA-jppx-rxg9-jmrx",
"GHSA-q4h4-gmj2-qvw2",
"GHSA-qpw4-5x99-6vjp",
"GHSA-rm3j-f69w-wqmq"
],
"fixed_version": "0.52.0",
"advisory_count": 27,
"oldest_advisory_days": 61
},
{
"name": "google.golang.org/grpc",
"direct": false,
"version": "v1.79.2",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-hrxh-6v49-42gf",
"GHSA-p77j-4mvh-x3m3",
"GO-2026-4762"
],
"fixed_version": "1.82.1",
"advisory_count": 3,
"oldest_advisory_days": 125
},
{
"name": "go.opentelemetry.io/otel/sdk",
"direct": true,
"version": "v1.41.0",
"severity": "high",
"ecosystem": "go",
"cvss_score": 7,
"advisory_ids": [
"GHSA-hfvc-g4fc-pqhx"
],
"fixed_version": "1.43.0",
"advisory_count": 1,
"oldest_advisory_days": 104
},
{
"name": "github.com/docker/docker",
"direct": false,
"version": "v28.5.2+incompatible",
"severity": "high",
"ecosystem": "go",
"cvss_score": 8.8,
"advisory_ids": [
"GHSA-pxq6-2prw-chj9",
"GHSA-rg2x-37c3-w2rh",
"GHSA-vp62-88p7-qqf5",
"GHSA-x744-4wpc-v9h2",
"GHSA-x86f-5xw2-fm2r",
"GO-2026-4883",
"GO-2026-4887",
"GO-2026-5617",
"GO-2026-5668",
"GO-2026-5746"
],
"fixed_version": "29.3.1",
"advisory_count": 10,
"oldest_advisory_days": 116
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp",
"direct": true,
"version": "v0.16.0",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 5.3,
"advisory_ids": [
"GHSA-w8rr-5gcm-pp58",
"GO-2026-4985"
],
"fixed_version": "1.43.0",
"advisory_count": 2,
"oldest_advisory_days": 104
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
"direct": true,
"version": "v1.41.0",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 5.3,
"advisory_ids": [
"GHSA-w8rr-5gcm-pp58",
"GO-2026-4985"
],
"fixed_version": "1.43.0",
"advisory_count": 2,
"oldest_advisory_days": 104
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
"direct": true,
"version": "v1.41.0",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 5.3,
"advisory_ids": [
"GHSA-w8rr-5gcm-pp58",
"GO-2026-4985"
],
"fixed_version": "1.43.0",
"advisory_count": 2,
"oldest_advisory_days": 104
},
{
"name": "github.com/go-chi/chi/v5",
"direct": false,
"version": "v5.2.2",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 4.7,
"advisory_ids": [
"GHSA-mqqf-5wvp-8fh8",
"GO-2026-4316"
],
"fixed_version": "5.2.4",
"advisory_count": 2,
"oldest_advisory_days": 188
},
{
"name": "github.com/gorilla/csrf",
"direct": false,
"version": "v1.7.3-0.20250123201450-9dd6af1f6d30",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GHSA-82ff-hg59-8x73",
"GHSA-rq77-p4h8-4crw",
"GO-2025-3607"
],
"fixed_version": "1.7.3",
"advisory_count": 3,
"oldest_advisory_days": 464
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.50.0",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 6.5,
"advisory_ids": [
"GHSA-5cv4-jp36-h3mw",
"GO-2026-4559",
"GO-2026-4918",
"GO-2026-5025",
"GO-2026-5026",
"GO-2026-5027",
"GO-2026-5028",
"GO-2026-5029",
"GO-2026-5030",
"GO-2026-5942"
],
"fixed_version": "1.26.3",
"advisory_count": 10,
"oldest_advisory_days": 145
},
{
"name": "filippo.io/edwards25519",
"direct": false,
"version": "v1.1.0",
"severity": "low",
"ecosystem": "go",
"cvss_score": 3.7,
"advisory_ids": [
"GHSA-fw7p-63qq-7hpr",
"GO-2026-4503"
],
"fixed_version": "1.1.1",
"advisory_count": 2,
"oldest_advisory_days": 154
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.41.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5024"
],
"fixed_version": "0.44.0",
"advisory_count": 1,
"oldest_advisory_days": 60
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.34.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5970"
],
"fixed_version": "0.39.0",
"advisory_count": 1,
"oldest_advisory_days": 7
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"low": 1,
"high": 2,
"unknown": 2,
"critical": 2,
"moderate": 6
},
"advisory_count": 66,
"affected_count": 13,
"assessed_count": 278,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 4
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/armon/go-socks5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20160902184237-e75332964ef5"
},
{
"name": "github.com/getlantern/algeneva",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20250307163401-1824e7b54f52"
},
{
"name": "github.com/getlantern/broflake",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20260717153233-f2cacf69fe86"
},
{
"name": "github.com/getlantern/geo",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20241129152027-2fc88c10f91e"
},
{
"name": "github.com/getlantern/lantern-water",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20260520145825-958775d51395"
},
{
"name": "github.com/getlantern/samizdat",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.3-0.20260529191731-5ea8ae61ddbf"
},
{
"name": "github.com/getlantern/semconv",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20260327040646-21845dda05cb"
},
{
"name": "github.com/gobwas/ws",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.4.0"
},
{
"name": "github.com/pion/transport/v4",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v4.0.1"
},
{
"name": "github.com/refraction-networking/water",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.7.1-alpha"
},
{
"name": "github.com/sagernet/sing",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.7.18"
},
{
"name": "github.com/sagernet/sing-box",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.12.22"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/stretchr/testify",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.11.1"
},
{
"name": "github.com/testcontainers/testcontainers-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.40.0"
},
{
"name": "github.com/tetratelabs/wazero",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.11.0"
},
{
"name": "go.opentelemetry.io/otel",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.16.0"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "go.opentelemetry.io/otel/log",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.16.0"
},
{
"name": "go.opentelemetry.io/otel/metric",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "go.opentelemetry.io/otel/sdk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "go.opentelemetry.io/otel/sdk/log",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.16.0"
},
{
"name": "go.opentelemetry.io/otel/sdk/metric",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "go.opentelemetry.io/otel/trace",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.41.0"
},
{
"name": "golang.getoutline.org/sdk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.21"
},
{
"name": "golang.getoutline.org/sdk/x",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.1.0"
},
{
"name": "gopkg.in/ini.v1",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.67.1"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/armon/go-socks5",
"direct": true,
"version": "v0.0.0-20160902184237-e75332964ef5",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/algeneva",
"direct": true,
"version": "v0.0.0-20250307163401-1824e7b54f52",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/broflake",
"direct": true,
"version": "v0.0.0-20260717153233-f2cacf69fe86",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/geo",
"direct": true,
"version": "v0.0.0-20241129152027-2fc88c10f91e",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/lantern-water",
"direct": true,
"version": "v0.0.0-20260520145825-958775d51395",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/samizdat",
"direct": true,
"version": "v0.0.3-0.20260529191731-5ea8ae61ddbf",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/semconv",
"direct": true,
"version": "v0.0.0-20260327040646-21845dda05cb",
"ecosystem": "go"
},
{
"name": "github.com/gobwas/ws",
"direct": true,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/pion/transport/v4",
"direct": true,
"version": "v4.0.1",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": true,
"version": "v1.11.1",
"ecosystem": "go"
},
{
"name": "github.com/testcontainers/testcontainers-go",
"direct": true,
"version": "v0.40.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp",
"direct": true,
"version": "v0.16.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/log",
"direct": true,
"version": "v0.16.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/metric",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk/log",
"direct": true,
"version": "v0.16.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk/metric",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/trace",
"direct": true,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "golang.getoutline.org/sdk",
"direct": true,
"version": "v0.0.21",
"ecosystem": "go"
},
{
"name": "golang.getoutline.org/sdk/x",
"direct": true,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "gopkg.in/ini.v1",
"direct": true,
"version": "v1.67.1",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": true,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "dario.cat/mergo",
"direct": false,
"version": "v1.0.2",
"ecosystem": "go"
},
{
"name": "filippo.io/edwards25519",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/ajg/form",
"direct": false,
"version": "v1.5.1",
"ecosystem": "go"
},
{
"name": "github.com/akutz/memconn",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/alecthomas/atomic",
"direct": false,
"version": "v0.1.0-alpha2",
"ecosystem": "go"
},
{
"name": "github.com/alexbrainman/sspi",
"direct": false,
"version": "v0.0.0-20231016080023-1a75b4708caa",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/btree",
"direct": false,
"version": "v0.0.0-20251201064447-d86c3fa41bd8",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/chansync",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/dht/v2",
"direct": false,
"version": "v2.23.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/envpprof",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/generics",
"direct": false,
"version": "v0.1.1-0.20251125230353-15d98d46693b",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/go-libutp",
"direct": false,
"version": "v1.3.2",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/log",
"direct": false,
"version": "v0.17.1-0.20251118025802-918f1157b7bb",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/missinggo",
"direct": false,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/missinggo/perf",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/missinggo/v2",
"direct": false,
"version": "v2.10.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/mmsg",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/multiless",
"direct": false,
"version": "v0.4.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/stm",
"direct": false,
"version": "v0.5.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/sync",
"direct": false,
"version": "v0.5.5-0.20251119100342-d78dd1f686f1",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/torrent",
"direct": false,
"version": "v1.61.0",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/upnp",
"direct": false,
"version": "v0.1.4",
"ecosystem": "go"
},
{
"name": "github.com/anacrolix/utp",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/andybalholm/brotli",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/anytls/sing-anytls",
"direct": false,
"version": "v0.0.11",
"ecosystem": "go"
},
{
"name": "github.com/azure/go-ansiterm",
"direct": false,
"version": "v0.0.0-20250102033503-faa5f7b0171c",
"ecosystem": "go"
},
{
"name": "github.com/bahlo/generic-list-go",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/benbjohnson/immutable",
"direct": false,
"version": "v0.4.1-0.20221220213129-8932b999621d",
"ecosystem": "go"
},
{
"name": "github.com/bits-and-blooms/bitset",
"direct": false,
"version": "v1.13.0",
"ecosystem": "go"
},
{
"name": "github.com/blang/vfs",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/bodgit/plumbing",
"direct": false,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "github.com/bodgit/sevenzip",
"direct": false,
"version": "v1.6.1",
"ecosystem": "go"
},
{
"name": "github.com/bodgit/windows",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/bradfitz/iter",
"direct": false,
"version": "v0.0.0-20191230175014-e8f45d346db8",
"ecosystem": "go"
},
{
"name": "github.com/caddyserver/certmagic",
"direct": false,
"version": "v0.23.0",
"ecosystem": "go"
},
{
"name": "github.com/caddyserver/zerossl",
"direct": false,
"version": "v0.1.3",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v4",
"direct": false,
"version": "v4.3.0",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v5",
"direct": false,
"version": "v5.0.3",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/coder/websocket",
"direct": false,
"version": "v1.8.13",
"ecosystem": "go"
},
{
"name": "github.com/containerd/errdefs",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/errdefs/pkg",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/log",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/platforms",
"direct": false,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/coreos/go-iptables",
"direct": false,
"version": "v0.7.1-0.20240112124308-65c67c9f46e6",
"ecosystem": "go"
},
{
"name": "github.com/cpuguy83/dockercfg",
"direct": false,
"version": "v0.3.2",
"ecosystem": "go"
},
{
"name": "github.com/cretz/bine",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/davecgh/go-spew",
"direct": false,
"version": "v1.1.2-0.20180830191138-d8f796af33cc",
"ecosystem": "go"
},
{
"name": "github.com/dblohm7/wingoes",
"direct": false,
"version": "v0.0.0-20240119213807-a09d6be7affa",
"ecosystem": "go"
},
{
"name": "github.com/digitalocean/go-smbios",
"direct": false,
"version": "v0.0.0-20180907143718-390a4f403a8e",
"ecosystem": "go"
},
{
"name": "github.com/distribution/reference",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/docker/docker",
"direct": false,
"version": "v28.5.2+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/docker/go-connections",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/docker/go-units",
"direct": false,
"version": "v0.5.0",
"ecosystem": "go"
},
{
"name": "github.com/dsnet/compress",
"direct": false,
"version": "v0.0.2-0.20230904184137-39efe44ab707",
"ecosystem": "go"
},
{
"name": "github.com/dustin/go-humanize",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/ebitengine/purego",
"direct": false,
"version": "v0.10.0",
"ecosystem": "go"
},
{
"name": "github.com/edsrzf/mmap-go",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/felixge/httpsnoop",
"direct": false,
"version": "v1.0.4",
"ecosystem": "go"
},
{
"name": "github.com/fsnotify/fsnotify",
"direct": false,
"version": "v1.9.0",
"ecosystem": "go"
},
{
"name": "github.com/fxamacker/cbor/v2",
"direct": false,
"version": "v2.7.0",
"ecosystem": "go"
},
{
"name": "github.com/gaissmai/bart",
"direct": false,
"version": "v0.11.1",
"ecosystem": "go"
},
{
"name": "github.com/gaukas/wazerofs",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/context",
"direct": false,
"version": "v0.0.0-20220418194847-3d5e7a086201",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/errors",
"direct": false,
"version": "v1.0.4",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/golog",
"direct": false,
"version": "v0.0.0-20230503153817-8e72de7e0a65",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/hex",
"direct": false,
"version": "v0.0.0-20220104173244-ad7e4b9194dc",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/hidden",
"direct": false,
"version": "v0.0.0-20220104173330-f221c5a24770",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/keepcurrent",
"direct": false,
"version": "v0.0.0-20260616120552-f204338b01a3",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/ops",
"direct": false,
"version": "v0.0.0-20231025133620-f368ab734534",
"ecosystem": "go"
},
{
"name": "github.com/getlantern/telemetry",
"direct": false,
"version": "v0.0.0-20250606052628-8960164ec1f5",
"ecosystem": "go"
},
{
"name": "github.com/go-chi/chi/v5",
"direct": false,
"version": "v5.2.2",
"ecosystem": "go"
},
{
"name": "github.com/go-chi/render",
"direct": false,
"version": "v1.0.3",
"ecosystem": "go"
},
{
"name": "github.com/go-json-experiment/json",
"direct": false,
"version": "v0.0.0-20250103232110-6a9a0fde9288",
"ecosystem": "go"
},
{
"name": "github.com/go-llsqlite/adapter",
"direct": false,
"version": "v0.0.0-20230927005056-7f5ce7f0c916",
"ecosystem": "go"
},
{
"name": "github.com/go-llsqlite/crawshaw",
"direct": false,
"version": "v0.5.6-0.20250312230104-194977a03421",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/logr",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/stdr",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/go-ole/go-ole",
"direct": false,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "github.com/go-stack/stack",
"direct": false,
"version": "v1.8.1",
"ecosystem": "go"
},
{
"name": "github.com/gobwas/httphead",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/gobwas/pool",
"direct": false,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/goccy/go-yaml",
"direct": false,
"version": "v1.19.0",
"ecosystem": "go"
},
{
"name": "github.com/godbus/dbus/v5",
"direct": false,
"version": "v5.1.1-0.20230522191255-76236955d466",
"ecosystem": "go"
},
{
"name": "github.com/gofrs/uuid/v5",
"direct": false,
"version": "v5.3.2",
"ecosystem": "go"
},
{
"name": "github.com/golang/groupcache",
"direct": false,
"version": "v0.0.0-20210331224755-41bb18bfe9da",
"ecosystem": "go"
},
{
"name": "github.com/google/btree",
"direct": false,
"version": "v1.1.3",
"ecosystem": "go"
},
{
"name": "github.com/google/go-cmp",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/google/nftables",
"direct": false,
"version": "v0.2.1-0.20240414091927-5e242ec57806",
"ecosystem": "go"
},
{
"name": "github.com/google/uuid",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/csrf",
"direct": false,
"version": "v1.7.3-0.20250123201450-9dd6af1f6d30",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/securecookie",
"direct": false,
"version": "v1.1.2",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/websocket",
"direct": false,
"version": "v1.5.3",
"ecosystem": "go"
},
{
"name": "github.com/grpc-ecosystem/grpc-gateway/v2",
"direct": false,
"version": "v2.28.0",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/golang-lru/v2",
"direct": false,
"version": "v2.0.7",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/yamux",
"direct": false,
"version": "v0.1.2",
"ecosystem": "go"
},
{
"name": "github.com/hdevalence/ed25519consensus",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/huandu/xstrings",
"direct": false,
"version": "v1.3.2",
"ecosystem": "go"
},
{
"name": "github.com/illarion/gonotify/v2",
"direct": false,
"version": "v2.0.3",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/insomniacslk/dhcp",
"direct": false,
"version": "v0.0.0-20250417080101-5f8cf70e8c5f",
"ecosystem": "go"
},
{
"name": "github.com/jsimonetti/rtnetlink",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/compress",
"direct": false,
"version": "v1.18.2",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/cpuid/v2",
"direct": false,
"version": "v2.2.11",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/pgzip",
"direct": false,
"version": "v1.2.6",
"ecosystem": "go"
},
{
"name": "github.com/kortschak/wol",
"direct": false,
"version": "v0.0.0-20200729010619-da482cc4850a",
"ecosystem": "go"
},
{
"name": "github.com/libdns/alidns",
"direct": false,
"version": "v1.0.5-libdns.v1.beta1",
"ecosystem": "go"
},
{
"name": "github.com/libdns/cloudflare",
"direct": false,
"version": "v0.2.2-0.20250708034226-c574dccb31a6",
"ecosystem": "go"
},
{
"name": "github.com/libdns/libdns",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/logrusorgru/aurora",
"direct": false,
"version": "v2.0.3+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/lufia/plan9stats",
"direct": false,
"version": "v0.0.0-20251013123823-9fd1530e3ec3",
"ecosystem": "go"
},
{
"name": "github.com/magiconair/properties",
"direct": false,
"version": "v1.8.10",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.20",
"ecosystem": "go"
},
{
"name": "github.com/mdlayher/genetlink",
"direct": false,
"version": "v1.3.2",
"ecosystem": "go"
},
{
"name": "github.com/mdlayher/netlink",
"direct": false,
"version": "v1.7.3-0.20250113171957-fbb4dce95f42",
"ecosystem": "go"
},
{
"name": "github.com/mdlayher/sdnotify",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/mdlayher/socket",
"direct": false,
"version": "v0.5.1",
"ecosystem": "go"
},
{
"name": "github.com/metacubex/tfo-go",
"direct": false,
"version": "v0.0.0-20250921095601-b102db4216c0",
"ecosystem": "go"
},
{
"name": "github.com/metacubex/utls",
"direct": false,
"version": "v1.8.4",
"ecosystem": "go"
},
{
"name": "github.com/mholt/acmez/v3",
"direct": false,
"version": "v3.1.2",
"ecosystem": "go"
},
{
"name": "github.com/mholt/archives",
"direct": false,
"version": "v0.1.5",
"ecosystem": "go"
},
{
"name": "github.com/microsoft/go-winio",
"direct": false,
"version": "v0.6.2",
"ecosystem": "go"
},
{
"name": "github.com/miekg/dns",
"direct": false,
"version": "v1.1.67",
"ecosystem": "go"
},
{
"name": "github.com/mikelolasagasti/xz",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/minio/minlz",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/minio/sha256-simd",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/go-ps",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/docker-image-spec",
"direct": false,
"version": "v1.3.1",
"ecosystem": "go"
},
{
"name": "github.com/moby/go-archive",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/patternmatcher",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/sys/sequential",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/sys/user",
"direct": false,
"version": "v0.4.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/sys/userns",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/term",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "github.com/morikuni/aec",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/mr-tron/base58",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/mschoch/smat",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/multiformats/go-multihash",
"direct": false,
"version": "v0.2.3",
"ecosystem": "go"
},
{
"name": "github.com/multiformats/go-varint",
"direct": false,
"version": "v0.0.6",
"ecosystem": "go"
},
{
"name": "github.com/nwaples/rardecode/v2",
"direct": false,
"version": "v2.2.0",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/go-digest",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/image-spec",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/oschwald/geoip2-golang",
"direct": false,
"version": "v1.9.0",
"ecosystem": "go"
},
{
"name": "github.com/oschwald/maxminddb-golang",
"direct": false,
"version": "v1.13.1",
"ecosystem": "go"
},
{
"name": "github.com/oxtoacart/bpool",
"direct": false,
"version": "v0.0.0-20190530202638-03653db5a59c",
"ecosystem": "go"
},
{
"name": "github.com/pierrec/lz4/v4",
"direct": false,
"version": "v4.1.22",
"ecosystem": "go"
},
{
"name": "github.com/pion/datachannel",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/pion/dtls/v3",
"direct": false,
"version": "v3.1.2",
"ecosystem": "go"
},
{
"name": "github.com/pion/ice/v4",
"direct": false,
"version": "v4.2.2",
"ecosystem": "go"
},
{
"name": "github.com/pion/interceptor",
"direct": false,
"version": "v0.1.44",
"ecosystem": "go"
},
{
"name": "github.com/pion/logging",
"direct": false,
"version": "v0.2.4",
"ecosystem": "go"
},
{
"name": "github.com/pion/mdns/v2",
"direct": false,
"version": "v2.1.0",
"ecosystem": "go"
},
{
"name": "github.com/pion/randutil",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/pion/rtcp",
"direct": false,
"version": "v1.2.16",
"ecosystem": "go"
},
{
"name": "github.com/pion/rtp",
"direct": false,
"version": "v1.10.1",
"ecosystem": "go"
},
{
"name": "github.com/pion/sctp",
"direct": false,
"version": "v1.9.4",
"ecosystem": "go"
},
{
"name": "github.com/pion/sdp/v3",
"direct": false,
"version": "v3.0.18",
"ecosystem": "go"
},
{
"name": "github.com/pion/srtp/v3",
"direct": false,
"version": "v3.0.10",
"ecosystem": "go"
},
{
"name": "github.com/pion/stun/v3",
"direct": false,
"version": "v3.1.1",
"ecosystem": "go"
},
{
"name": "github.com/pion/turn/v4",
"direct": false,
"version": "v4.1.4",
"ecosystem": "go"
},
{
"name": "github.com/pion/webrtc/v4",
"direct": false,
"version": "v4.2.11",
"ecosystem": "go"
},
{
"name": "github.com/pkg/errors",
"direct": false,
"version": "v0.9.1",
"ecosystem": "go"
},
{
"name": "github.com/pmezard/go-difflib",
"direct": false,
"version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
"ecosystem": "go"
},
{
"name": "github.com/power-devops/perfstat",
"direct": false,
"version": "v0.0.0-20240221224432-82ca36839d55",
"ecosystem": "go"
},
{
"name": "github.com/prometheus-community/pro-bing",
"direct": false,
"version": "v0.4.0",
"ecosystem": "go"
},
{
"name": "github.com/protolambda/ctxlock",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/refraction-networking/utls",
"direct": false,
"version": "v1.8.2",
"ecosystem": "go"
},
{
"name": "github.com/remyoudompheng/bigfft",
"direct": false,
"version": "v0.0.0-20230129092748-24d4a6f8daec",
"ecosystem": "go"
},
{
"name": "github.com/roaringbitmap/roaring",
"direct": false,
"version": "v1.2.3",
"ecosystem": "go"
},
{
"name": "github.com/rs/dnscache",
"direct": false,
"version": "v0.0.0-20211102005908-e0241e321417",
"ecosystem": "go"
},
{
"name": "github.com/safchain/ethtool",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/bbolt",
"direct": false,
"version": "v0.0.0-20231014093535-ea5cb2fe9f0a",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/cors",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/fswatch",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/gvisor",
"direct": false,
"version": "v0.0.0-20250325023245-7a9c0f5725fb",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/netlink",
"direct": false,
"version": "v0.0.0-20240612041022-b9a21c07ac6a",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/nftables",
"direct": false,
"version": "v0.3.0-beta.4",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/quic-go",
"direct": false,
"version": "v0.52.0-sing-box-mod.3",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-mux",
"direct": false,
"version": "v0.3.4",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-quic",
"direct": false,
"version": "v0.5.3",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-shadowsocks",
"direct": false,
"version": "v0.2.8",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-shadowsocks2",
"direct": false,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-shadowtls",
"direct": false,
"version": "v0.2.1-0.20250503051639-fcd445d33c11",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-tun",
"direct": false,
"version": "v0.7.11",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/sing-vmess",
"direct": false,
"version": "v0.2.7",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/smux",
"direct": false,
"version": "v1.5.50-sing-box-mod.1",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/tailscale",
"direct": false,
"version": "v1.80.3-sing-box-1.12-mod.2",
"ecosystem": "go"
},
{
"name": "github.com/sagernet/ws",
"direct": false,
"version": "v0.0.0-20231204124109-acfe8907c854",
"ecosystem": "go"
},
{
"name": "github.com/shadowsocks/go-shadowsocks2",
"direct": false,
"version": "v0.1.5",
"ecosystem": "go"
},
{
"name": "github.com/shirou/gopsutil/v4",
"direct": false,
"version": "v4.26.2",
"ecosystem": "go"
},
{
"name": "github.com/sirupsen/logrus",
"direct": false,
"version": "v1.9.3",
"ecosystem": "go"
},
{
"name": "github.com/sorairolake/lzip-go",
"direct": false,
"version": "v0.3.8",
"ecosystem": "go"
},
{
"name": "github.com/spaolacci/murmur3",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/afero",
"direct": false,
"version": "v1.15.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": false,
"version": "v1.0.9",
"ecosystem": "go"
},
{
"name": "github.com/starry-s/zip",
"direct": false,
"version": "v0.2.3",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/objx",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/certstore",
"direct": false,
"version": "v0.1.1-0.20231202035212-d3fa0460f47e",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/go-winio",
"direct": false,
"version": "v0.0.0-20231025203758-c4f33415bf55",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/golang-x-crypto",
"direct": false,
"version": "v0.0.0-20240604161659-3fde5e568aa4",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/goupnp",
"direct": false,
"version": "v1.0.1-0.20210804011211-c64d0f06ea05",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/hujson",
"direct": false,
"version": "v0.0.0-20221223112325-20486734a56a",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/netlink",
"direct": false,
"version": "v1.1.1-0.20240822203006-4d49adab4de7",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/peercred",
"direct": false,
"version": "v0.0.0-20250107143737-35a0c7bd7edc",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/web-client-prebuilt",
"direct": false,
"version": "v0.0.0-20250124233751-d4cd19a26976",
"ecosystem": "go"
},
{
"name": "github.com/tevino/abool/v2",
"direct": false,
"version": "v2.1.0",
"ecosystem": "go"
},
{
"name": "github.com/theodorsm/covert-dtls",
"direct": false,
"version": "v1.5.0",
"ecosystem": "go"
},
{
"name": "github.com/tidwall/btree",
"direct": false,
"version": "v1.8.1",
"ecosystem": "go"
},
{
"name": "github.com/tklauser/go-sysconf",
"direct": false,
"version": "v0.3.16",
"ecosystem": "go"
},
{
"name": "github.com/tklauser/numcpus",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/u-root/uio",
"direct": false,
"version": "v0.0.0-20240224005618-d2acac8f3701",
"ecosystem": "go"
},
{
"name": "github.com/ulikunitz/xz",
"direct": false,
"version": "v0.5.15",
"ecosystem": "go"
},
{
"name": "github.com/vishvananda/netns",
"direct": false,
"version": "v0.0.5",
"ecosystem": "go"
},
{
"name": "github.com/wlynxg/anet",
"direct": false,
"version": "v0.0.5",
"ecosystem": "go"
},
{
"name": "github.com/x448/float16",
"direct": false,
"version": "v0.8.4",
"ecosystem": "go"
},
{
"name": "github.com/yusufpapurcu/wmi",
"direct": false,
"version": "v1.2.4",
"ecosystem": "go"
},
{
"name": "github.com/zeebo/blake3",
"direct": false,
"version": "v0.2.4",
"ecosystem": "go"
},
{
"name": "go.etcd.io/bbolt",
"direct": false,
"version": "v1.3.6",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/auto/sdk",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
"direct": false,
"version": "v0.49.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
"direct": false,
"version": "v1.41.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/proto/otlp",
"direct": false,
"version": "v1.9.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/mock",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "go.uber.org/multierr",
"direct": false,
"version": "v1.11.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/zap",
"direct": false,
"version": "v1.27.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/zap/exp",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "go4.org",
"direct": false,
"version": "v0.0.0-20230225012048-214862532bf5",
"ecosystem": "go"
},
{
"name": "go4.org/mem",
"direct": false,
"version": "v0.0.0-20240501181205-ae6ca9944745",
"ecosystem": "go"
},
{
"name": "go4.org/netipx",
"direct": false,
"version": "v0.0.0-20231129151722-fdeea329fbba",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.48.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/exp",
"direct": false,
"version": "v0.0.0-20251113190631-e25ba8c21ef6",
"ecosystem": "go"
},
{
"name": "golang.org/x/mod",
"direct": false,
"version": "v0.32.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.50.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.19.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.41.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": false,
"version": "v0.40.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.34.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/time",
"direct": false,
"version": "v0.14.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/tools",
"direct": false,
"version": "v0.41.0",
"ecosystem": "go"
},
{
"name": "golang.zx2c4.com/wintun",
"direct": false,
"version": "v0.0.0-20230126152724-0fa3db229ce2",
"ecosystem": "go"
},
{
"name": "golang.zx2c4.com/wireguard/windows",
"direct": false,
"version": "v0.5.3",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/api",
"direct": false,
"version": "v0.0.0-20260209200024-4cfbd4190f57",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20260209200024-4cfbd4190f57",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": false,
"version": "v1.79.2",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": false,
"version": "v1.36.11",
"ecosystem": "go"
},
{
"name": "lukechampine.com/blake3",
"direct": false,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "modernc.org/libc",
"direct": false,
"version": "v1.22.3",
"ecosystem": "go"
},
{
"name": "modernc.org/mathutil",
"direct": false,
"version": "v1.5.0",
"ecosystem": "go"
},
{
"name": "modernc.org/memory",
"direct": false,
"version": "v1.5.0",
"ecosystem": "go"
},
{
"name": "modernc.org/sqlite",
"direct": false,
"version": "v1.21.1",
"ecosystem": "go"
},
{
"name": "zombiezen.com/go/sqlite",
"direct": false,
"version": "v0.13.1",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 278,
"direct_count": 26,
"indirect_count": 252
}
},
"maintainership": {
"issues": {
"open_prs": 14,
"merged_prs": 253,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 21
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "myleshorton",
"commits": 392,
"avatar_url": "https://avatars.githubusercontent.com/u/1143966?v=4"
},
{
"type": "User",
"login": "garmr-ulfr",
"commits": 71,
"avatar_url": "https://avatars.githubusercontent.com/u/104022054?v=4"
},
{
"type": "User",
"login": "WendelHime",
"commits": 60,
"avatar_url": "https://avatars.githubusercontent.com/u/6754291?v=4"
},
{
"type": "User",
"login": "AGMETEOR",
"commits": 59,
"avatar_url": "https://avatars.githubusercontent.com/u/28563179?v=4"
},
{
"type": "User",
"login": "jay-418",
"commits": 43,
"avatar_url": "https://avatars.githubusercontent.com/u/110402935?v=4"
},
{
"type": "User",
"login": "theluckiestsoul",
"commits": 35,
"avatar_url": "https://avatars.githubusercontent.com/u/34510940?v=4"
},
{
"type": "User",
"login": "reflog",
"commits": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/109876?v=4"
},
{
"type": "User",
"login": "thomasjib",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/107058915?v=4"
}
],
"contributors_sampled": 8,
"top_contributor_share": 0.582
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"auto-tag.yaml",
"build-images.yaml",
"e2e.yaml",
"go.yaml",
"push.yaml",
"push_branch.yaml",
"release.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 9,
"reason": "17 out of 18 merged PRs checked by a CI test -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 3,
"reason": "Found 6/18 approved changesets -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "38 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "5059a0fdd07b1359c4740fc856752fdee187d10b",
"ran_at": "2026-07-22T15:40:12Z",
"aggregate_score": 3.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-17T22:43:25Z",
"oldest_open_prs": [
{
"number": 8,
"created_at": "2025-04-16T23:10:56Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 17,
"created_at": "2025-06-10T21:33:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 20,
"created_at": "2025-06-20T16:56:25Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 34,
"created_at": "2025-08-20T21:14:09Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 54,
"created_at": "2025-11-20T01:32:53Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 66,
"created_at": "2025-12-11T09:02:07Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 95,
"created_at": "2026-01-19T07:41:28Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 238,
"created_at": "2026-04-14T16:18:03Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 255,
"created_at": "2026-05-08T02:26:37Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 256,
"created_at": "2026-05-08T03:03:51Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 257,
"created_at": "2026-05-08T20:08:58Z",
"last_comment_at": "2026-05-14T23:28:01Z",
"last_comment_author": "myleshorton"
},
{
"number": 262,
"created_at": "2026-05-14T21:56:38Z",
"last_comment_at": "2026-05-14T22:35:03Z",
"last_comment_author": "garmr-ulfr"
},
{
"number": 263,
"created_at": "2026-05-14T22:56:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 279,
"created_at": "2026-06-18T10:51:29Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-17T22:42:04Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 264,
"created_at": "2026-05-14T23:27:24Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/getlantern/lantern-box",
"host": "github.com",
"name": "lantern-box",
"owner": "getlantern"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"security": 39,
"vitality": 94,
"community": 23,
"governance": 60,
"engineering": 60
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 94,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 96,
"inputs": {
"commits_last_year": 606,
"human_commit_share": 1,
"days_since_last_push": 4,
"active_weeks_last_year": 46
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "46/52 weeks with commits",
"points": 31.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 46
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "606 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 606
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 99,
"latest_release_tag": "v0.0.104",
"releases_from_tags": false,
"days_since_latest_release": 4,
"mean_days_between_releases": 3.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "99 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 99
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 4,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 4 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 4
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 23,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 21,
"inputs": {
"forks": 3,
"stars": 10,
"watchers": 5,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "10 stars",
"points": 15.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 10
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "3 forks",
"points": 2.5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 3
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "5 watchers",
"points": 3.3,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 5
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 60,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 35,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 8,
"top_contributor_share": 0.582
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 58% of commits",
"points": 9.4,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 58
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "8 contributors",
"points": 10.8,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 8
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"merged_prs": 253,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 21
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "253/274 decided PRs merged",
"points": 35.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 253,
"decided": 274
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 6/18 approved changesets -- score normalized to 3",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"followers": 1274,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "getlantern",
"public_repos": 475,
"account_age_days": 5633
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1,274 followers of getlantern",
"points": 22.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1274,
"login": "getlantern"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "475 public repos, account ~15 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 475
}
},
{
"code": "account_age_years",
"params": {
"years": 15
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/getlantern/lantern-box"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 4
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 4 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 4
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "104 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 104
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 60,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "7 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 7
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "17 out of 18 merged PRs checked by a CI test -- score normalized to 9",
"points": 18,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 39,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": null,
"notes": [],
"value": 36,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 3.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "17 out of 18 merged PRs checked by a CI test -- score normalized to 9",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 6/18 approved changesets -- score normalized to 3",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "38 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "at_risk",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 278 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 278
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 49,
"inputs": {
"source": "osv",
"advisories": 66,
"affected_packages": 13,
"assessed_packages": 278,
"unassessed_packages": 0,
"affected_by_severity": "critical 2, high 2, moderate 6, low 1, unknown 2",
"direct_affected_packages": 4
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "4 affected: go.opentelemetry.io/otel/sdk v1.41.0 (high 7.0), go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 (moderate 5.3), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.41.0 (moderate 5.3), +1 more",
"points": 11,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 4,
"packages": "go.opentelemetry.io/otel/sdk v1.41.0 (high 7.0), go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 (moderate 5.3), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.41.0 (moderate 5.3)"
}
},
{
"code": "advisories_affected_more",
"params": {
"count": 1
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "4 advisory-carrying package(s) unaddressed past 90 days; oldest published 104 days ago",
"points": 25.4,
"status": "partial",
"details": [
{
"code": "advisories_stale",
"params": {
"days": 90,
"count": 4,
"oldest": 104
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 278,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 3
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 72,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "moderate",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.96,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 98
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md (stub)",
"points": 18,
"status": "partial",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
},
{
"code": "agent_instructions_stub",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "96 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 96,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 71,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile",
"cmd/Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.43,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, cmd/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, cmd/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "43 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 43,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 50657,
"source_files_sampled": 120,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/120 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 120,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-22T15:40:34.327309Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/getlantern/lantern-box.svg",
"full_name": "getlantern/lantern-box",
"license_state": "absent",
"license_spdx": null
}
Пов’язані записи
Перевірені репозиторії, що мають спільні каталожні теги або екосистеми з getlantern/lantern-box. Читати поруч →
Оцінки — це сигнали, а не гарантії. Вони відображають публічно видимі практики на GitHub — це не аудит коду й не гарантія безпеки.
Відсутні дані виключаються, а ваги перенормовуються — нуль за відсутність ніколи не ставиться. Методологія версіонована й відкрита: метрики v1.13.0, схема v0.26.0 — повна методологія · вікі метрик.
