公开记录良好
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-25 19:09 UTC
SonarSource / sonar-analyzer-commons
Logic useful for a language plugin
SonarSource/sonar-analyzer-commons 的健康指数为 100 分中的 74 分，处于「良好」区间。 其得分最高的类别是Sustainability & Governance（92/100），最低的是Community & Adoption（48/100）。 最近一次更新在今天。 近期的大部分工作由 8 位贡献者完成。
74
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
74
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 |
|---|---|---|---|---|---|
| Maven | org.sonarsource.analyzer-commons:sonar-analyzer-commons | 2.29.0.5138 | - | 65 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:sonar-analyzer-recognizers | 2.29.0.5138 | - | 57 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:sonar-xml-parsing | 2.29.0.5138 | - | 55 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:sonar-analyzer-test-commons | 2.29.0.5138 | - | 63 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:sonar-regex-parsing | 2.29.0.5138 | - | 48 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:test-sonar-xml-parsing | 2.29.0.5138 | - | 50 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:sonar-performance-measure | 2.29.0.5138 | - | 45 | 2 天前 |
| Maven | org.sonarsource.analyzer-commons:sonar-analyzer-commons-configurations | 2.29.0.5138 | - | 4 | 2 天前 |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
84
开发活跃度
74良好
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 0 天前 |
| 11.1/36 | 提交节奏 — 52 周中有 16 周有提交 |
| 17.3/18 | 提交量 — 最近一年 84 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 84 |
| human_commit_share | 0.85 |
| days_since_last_push | 0 |
| active_weeks_last_year | 16 |
发布纪律
100优秀
评分方式
| 27/27 | 有发布版本 — 已发布 49 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 2 天前 |
| 27/27 | 发布节奏 — 约每 27.2 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 49 |
| latest_release_tag | 2.29.0.5138 |
| releases_from_tags | 否 |
| days_since_latest_release | 2 |
| mean_days_between_releases | 27.2 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
48
流行度与采用
40存在风险
评分方式
| 23.2/60 | 星标 — 28 个星标 |
| 9.3/25 | 复刻 — 14 个复刻 |
| 7.7/15 | 关注者 — 25 位关注者 |
所用输入
| forks | 14 |
| stars | 28 |
| watchers | 25 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
57中等
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（LGPL-3.0） |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 6.3/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 是 |
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
92
维护者韧性（巴士系数）
97优秀
评分方式
| 54/54 | 巴士系数 — 8 位贡献者贡献了半数提交 |
| 19.4/22.5 | 提交分布 — 头号贡献者编写了 14% 的提交 |
| 13.5/13.5 | 贡献者广度 — 59 位贡献者 |
| 10/10 | OpenSSF Scorecard：Contributors — project has 13 contributing companies or organizations |
所用输入
| bus_factor | 8 |
| contributors_sampled | 59 |
| top_contributor_share | 0.136 |
议题与 PR 响应能力
95优秀
评分方式
| 46.1/46.8 | 议题解决 — 99% 的议题已关闭 |
| 34.2/38.3 | PR 接受 — 已裁定的 PR 中 351/393 已合并 |
| 15/15 | OpenSSF Scorecard：Code-Review — all changesets reviewed |
所用输入
| merged_prs | 351 |
| open_issues | 1 |
| closed_issues | 75 |
| issue_closed_ratio | 0.987 |
| closed_unmerged_prs | 42 |
所有权与托管责任
77良好
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 22.1/25 | 所有者影响力 — SonarSource 有 1,189 位关注者 |
| 25/25 | 既往记录 — 256 个公开仓库，账户约 15 年 |
所用输入
| followers | 1,189 |
| owner_type | Organization |
| is_verified | — |
| owner_login | SonarSource |
| public_repos | 256 |
| account_age_days | 5,681 |
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — maven 上有 8 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 2 天前 |
| 20/20 | 版本历史 — 65 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | org.sonarsource.analyzer-commons:sonar-analyzer-commons, org.sonarsource.analyzer-commons:sonar-analyzer-recognizers, org.sonarsource.analyzer-commons:sonar-xml-parsing, org.sonarsource.analyzer-commons:sonar-analyzer-test-commons, org.sonarsource.analyzer-commons:sonar-regex-parsing, org.sonarsource.analyzer-commons:test-sonar-xml-parsing, org.sonarsource.analyzer-commons:sonar-performance-measure, org.sonarsource.analyzer-commons:sonar-analyzer-commons-configurations |
| ecosystems | maven |
| any_deprecated | 否 |
| min_days_since_publish | 2 |
工程质量
基础的工程与文档实践是否到位？
61
工程实践
68中等
评分方式
| 24/24 | CI 工作流 — 9 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
50中等
评分方式
| 30/30 | README |
| 0/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 1 个主题标签 |
| 0/10 | Wiki |
所用输入
| topics | language-team |
| has_wiki | 否 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 否 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
80
安全态势
75良好
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 3.8/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 2.5/2.5 | CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 7.5/7.5 | Code-Review — all changesets reviewed |
| 2.5/2.5 | Contributors — project has 13 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 1/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 2 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 3.8/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 7.5 |
已排除计分（无数据或不适用）：signed_releases。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 25/25 | 间接依赖不含已知公告 — 没有间接依赖携带已知公告 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 3 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 maven:org.sonarsource.analyzer-commons:sonar-analyzer-commons@2.29.0.5138 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 3 个软件包。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
65
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 85 次人类提交中有 65 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.765 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 18/18 | 一条命令的引导启动 — mise.toml |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — Java（静态类型） |
| 0/10 | 可复现环境 |
| 10/10 | 已体现的代理实践 — 最近 100 次提交中有 9 次由代理编写或署名代理 |
| 8/8 | 自动化维护 — 最近 100 次提交中有 15 次为自动依赖更新 |
| 2/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 2 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | — |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | mise.toml |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | — |
| agent_commit_share | 0.09 |
| toolchain_manifests | commons/pom.xml, performance-measure/pom.xml, pom.xml, recognizers/pom.xml, regex-parsing/pom.xml, sonar-analyzer-commons-configurations/pom.xml, test-commons/pom.xml, test-xml-parsing/pom.xml, xml-parsing/pom.xml |
| dependency_bot_commit_share | 0.15 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — Java（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 356 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | Java |
| largest_source_bytes | 47,661 |
| source_files_sampled | 356 |
| oversized_source_files | 0 |
关键数据
28GitHub 星标
59贡献者
84最近 12 个月提交数
0距最近推送天数
49发布版本数
8巴士系数（bus factor）
1开放议题
Maven软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
Star 与 Fork 历史 0 ★ / 14 ⇿
0Star
14Fork
42发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 0次版本 0修订 0
每个点涵盖 8 天。
OpenSSF Scorecard 7.5 / 10
7.5综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 5 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 10 | CI-Tests | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 10 | Code-Review | all changesets reviewed |
| 10 | Contributors | project has 13 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 2 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 2 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 10 | Security-Policy | security policy file detected |
| 不适用 | Signed-Releases | no releases found |
| 5 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
直接依赖 28
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| Maven | com.google.code.findbugs:jsr305 | — | commons/pom.xml |
| Maven | com.googlecode.json-simple:json-simple | — | commons/pom.xml |
| Maven | com.google.code.findbugs:jsr305 | — | performance-measure/pom.xml |
| Maven | com.google.code.gson:gson | — | performance-measure/pom.xml |
| Maven | org.sonarsource.scanner.engine:plugin-api-scanner-impl | ${version.sonar.scanner} | pom.xml |
| Maven | org.sonarsource.scanner.engine:sensor-test-fixtures | ${version.sonar.scanner} | pom.xml |
| Maven | org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures | ${version.sonar.plugin.api} | pom.xml |
| Maven | com.google.code.findbugs:jsr305 | ${version.jsr305} | pom.xml |
| Maven | com.googlecode.json-simple:json-simple | 1.1.1 | pom.xml |
| Maven | com.google.code.gson:gson | ${version.gson} | pom.xml |
| Maven | junit:junit | ${version.junit} | pom.xml |
| Maven | org.junit:junit-bom | ${version.junit-jupiter} | pom.xml |
| Maven | org.assertj:assertj-core | ${version.assertj} | pom.xml |
| Maven | org.mockito:mockito-core | ${version.mockito} | pom.xml |
| Maven | com.google.code.findbugs:jsr305 | — | recognizers/pom.xml |
| Maven | com.google.code.findbugs:jsr305 | — | regex-parsing/pom.xml |
| Maven | org.sonarsource.analyzer-commons:sonar-analyzer-commons | ${project.version} | sonar-analyzer-commons-configurations/pom.xml |
| Maven | com.google.code.gson:gson | — | sonar-analyzer-commons-configurations/pom.xml |
| Maven | com.google.code.findbugs:jsr305 | — | test-commons/pom.xml |
| Maven | junit:junit | — | test-commons/pom.xml |
| Maven | org.sonarsource.scanner.engine:plugin-api-scanner-impl | — | test-xml-parsing/pom.xml |
| Maven | org.sonarsource.scanner.engine:sensor-test-fixtures | — | test-xml-parsing/pom.xml |
| Maven | com.google.code.findbugs:jsr305 | — | test-xml-parsing/pom.xml |
| Maven | org.sonarsource.analyzer-commons:sonar-xml-parsing | ${project.version} | test-xml-parsing/pom.xml |
| Maven | org.sonarsource.analyzer-commons:sonar-analyzer-test-commons | ${project.version} | test-xml-parsing/pom.xml |
| Maven | com.google.code.findbugs:jsr305 | — | xml-parsing/pom.xml |
| Maven | xerces:xercesImpl | 2.12.2 | xml-parsing/pom.xml |
| Maven | com.fasterxml.woodstox:woodstox-core | 7.2.1 | xml-parsing/pom.xml |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
依赖安全公告 0
安装 maven:org.sonarsource.analyzer-commons:sonar-analyzer-commons@2.29.0.5138 会引入 3 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。
没有已知公告影响已评估的依赖。
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"language-team"
],
"is_fork": false,
"size_kb": 2098,
"has_wiki": false,
"homepage": null,
"languages": {
"HTML": 4246,
"Java": 1501893,
"JavaScript": 1127
},
"pushed_at": "2026-07-25T18:48:46Z",
"created_at": "2017-07-17T15:32:22Z",
"owner_type": "Organization",
"updated_at": "2026-07-23T17:29:09Z",
"description": "Logic useful for a language plugin",
"is_archived": false,
"is_disabled": false,
"license_spdx": "LGPL-3.0",
"default_branch": "master",
"license_spdx_raw": "LGPL-3.0",
"primary_language": "Java",
"significant_languages": [
"Java"
]
},
"owner": {
"blog": "https://www.sonarsource.com",
"name": "Sonar",
"type": "Organization",
"login": "SonarSource",
"company": null,
"location": "Switzerland",
"followers": 1189,
"avatar_url": "https://avatars.githubusercontent.com/u/545988?v=4",
"created_at": "2011-01-03T20:41:22Z",
"is_verified": null,
"public_repos": 256,
"account_age_days": 5681
},
"license": {
"state": "standard",
"spdx_id": "LGPL-3.0",
"raw_spdx": "LGPL-3.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "2.29.0.5138",
"kind": "other",
"published_at": "2026-07-23T08:31:54Z"
},
{
"tag": "2.28.0.5085",
"kind": "other",
"published_at": "2026-07-17T15:57:20Z"
},
{
"tag": "2.27.0.5007",
"kind": "other",
"published_at": "2026-07-07T08:19:59Z"
},
{
"tag": "2.26.0.4969",
"kind": "other",
"published_at": "2026-07-03T09:13:54Z"
},
{
"tag": "2.25.0.4954",
"kind": "other",
"published_at": "2026-07-01T14:24:00Z"
},
{
"tag": "2.24.0.4903",
"kind": "other",
"published_at": "2026-06-15T14:09:55Z"
},
{
"tag": "2.23.0.4877'",
"kind": "other",
"published_at": "2026-06-10T13:01:22Z"
},
{
"tag": "2.22.0.4796",
"kind": "other",
"published_at": "2026-04-20T12:10:13Z"
},
{
"tag": "2.21.0.4626",
"kind": "other",
"published_at": "2025-12-02T16:44:12Z"
},
{
"tag": "2.20.0.4607",
"kind": "other",
"published_at": "2025-11-20T10:43:24Z"
},
{
"tag": "2.19.0.3575",
"kind": "other",
"published_at": "2025-11-03T14:34:12Z"
},
{
"tag": "2.18.0.3393",
"kind": "other",
"published_at": "2025-05-23T09:25:47Z"
},
{
"tag": "2.17.0.3322",
"kind": "other",
"published_at": "2025-04-01T12:17:50Z"
},
{
"tag": "2.16.0.3141",
"kind": "other",
"published_at": "2024-11-15T08:19:14Z"
},
{
"tag": "2.15.0.3128",
"kind": "other",
"published_at": "2024-11-07T16:08:23Z"
},
{
"tag": "2.14.0.3087",
"kind": "other",
"published_at": "2024-10-09T10:12:11Z"
},
{
"tag": "2.13.0.3004",
"kind": "other",
"published_at": "2024-08-22T11:33:40Z"
},
{
"tag": "2.12.0.2964",
"kind": "other",
"published_at": "2024-07-30T13:59:36Z"
},
{
"tag": "2.11.0.2861",
"kind": "other",
"published_at": "2024-05-13T15:02:33Z"
},
{
"tag": "2.10.0.2849",
"kind": "other",
"published_at": "2024-05-10T14:58:31Z"
},
{
"tag": "2.9.0.2753",
"kind": "other",
"published_at": "2024-04-02T09:20:18Z"
},
{
"tag": "2.8.0.2699",
"kind": "other",
"published_at": "2024-02-21T13:18:26Z"
},
{
"tag": "2.7.0.1482",
"kind": "other",
"published_at": "2023-08-11T15:00:16Z"
},
{
"tag": "2.6.0.1473",
"kind": "other",
"published_at": "2023-08-10T15:55:07Z"
},
{
"tag": "2.5.0.1358",
"kind": "other",
"published_at": "2023-05-05T13:13:49Z"
},
{
"tag": "2.4.0.1317",
"kind": "other",
"published_at": "2023-03-29T10:19:50Z"
},
{
"tag": "2.3.0.1263",
"kind": "other",
"published_at": "2023-03-07T16:44:17Z"
},
{
"tag": "2.2.0.1251",
"kind": "other",
"published_at": "2023-03-01T10:59:40Z"
},
{
"tag": "2.1.0.1111",
"kind": "other",
"published_at": "2022-10-31T15:32:15Z"
},
{
"tag": "2.0.1.1099",
"kind": "other",
"published_at": "2022-10-28T09:41:43Z"
},
{
"tag": "2.0.0.1075",
"kind": "other",
"published_at": "2022-10-14T08:46:28Z"
},
{
"tag": "1.28.0.1058",
"kind": "other",
"published_at": "2022-08-19T09:39:02Z"
},
{
"tag": "1.27.0.1040",
"kind": "other",
"published_at": "2022-08-05T08:26:13Z"
},
{
"tag": "1.26.0.1029",
"kind": "other",
"published_at": "2022-07-22T12:54:47Z"
},
{
"tag": "1.25.0.1003",
"kind": "other",
"published_at": "2022-05-13T07:55:51Z"
},
{
"tag": "1.24.0.965",
"kind": "other",
"published_at": "2022-02-08T14:23:37Z"
},
{
"tag": "1.23.0.957",
"kind": "other",
"published_at": "2022-02-07T12:11:17Z"
},
{
"tag": "1.22.0.848",
"kind": "other",
"published_at": "2021-11-19T15:01:57Z"
},
{
"tag": "1.21.0.829",
"kind": "other",
"published_at": "2021-11-05T14:33:27Z"
},
{
"tag": "1.20.0.801",
"kind": "other",
"published_at": "2021-10-26T08:02:11Z"
},
{
"tag": "1.19.0.786",
"kind": "other",
"published_at": "2021-10-12T09:26:18Z"
},
{
"tag": "1.18.0.756",
"kind": "other",
"published_at": "2021-09-10T15:12:44Z"
},
{
"tag": "1.17.0.740",
"kind": "other",
"published_at": "2021-09-03T12:01:00Z"
},
{
"tag": "1.16.0.719",
"kind": "other",
"published_at": "2021-08-09T09:27:26Z"
},
{
"tag": "1.15.0.699",
"kind": "other",
"published_at": "2021-05-21T08:26:20Z"
},
{
"tag": "1.14.1.690",
"kind": "other",
"published_at": "2021-04-28T15:26:56Z"
},
{
"tag": "1.14.0.681",
"kind": "other",
"published_at": "2021-03-24T15:30:52Z"
},
{
"tag": "1.13.0.662",
"kind": "other",
"published_at": "2021-02-15T09:40:32Z"
},
{
"tag": "1.12.0.632",
"kind": "other",
"published_at": "2020-09-07T10:13:59Z"
}
],
"recent_commits": [
{
"oid": "915b718d0675327a4e2df0cbd1f0caf3a6a13ca8",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update SonarSource/sonar-scanner-engine monorepo to v13.5.0.4089 (#471)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-23T17:29:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8bcb1967ed130490c29a89d2ab14b6429140ee6",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update jdx/mise-action action to v4.2.1 (#460)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-23T13:47:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2bf28c7a20ad372a96c25160a859fc54b165de5b",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update actions/setup-node action to v7 (#469)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-23T13:47:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae2dc590d1145fe6216ed3753dcc6e97d7574516",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-108 Prepare for next development iteration (#470)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2026-07-23T11:34:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61228cdbb1b768af9a487defb6d122e9029422e6",
"body": "Drop Vault sonartech_npm_token and .npmrc _authToken so npm uses\nGitHub OIDC. Extract the Repox tarball and publish with --provenance,\nmatching gh-action_release Trusted Publisher flow.",
"is_bot": false,
"headline": "PREQ-7435 Publish npm via Trusted Publisher OIDC (#467)",
"author_name": "tomverin",
"author_login": "tomverin",
"committed_at": "2026-07-23T09:30:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67c0c8d930e08a9eefa44aa42c51c78865869e81",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-104 Add required Readme to the Nuget package (#464)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2026-07-23T07:32:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3baa74786458351522601709ecd4e7d9675ab77",
"body": "* PREQ-7434 Fix DigiCert NuGet signing after smctl no-op\n\nMaster build signed with a stale key_525594307 fallback; smctl sign\nexited without a jsign-detectable signature. Resolve ACTIVE cert/keypair\naliases from smctl, bump jsign to 7.5, and sign via DIGICERTONE then\nPKCS11 fallbacks (same DigiCert \n[…]\n-branch workflow_dispatch only runs mvn verify (deployed=false).\nPrepare/sign the local nupkg when forceDigicertSign is set, and skip\npromote so the DigiCert result is not masked by a promote failure.",
"is_bot": false,
"headline": "PREQ-7434 Fix DigiCert NuGet signing after smctl no-op (#466)",
"author_name": "tomverin",
"author_login": "tomverin",
"committed_at": "2026-07-23T07:24:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6d5437b13f7c0a843097038f9083fb59568e0006",
"body": "* PREQ-7434 Sign NuGet packages with DigiCert instead of Azure\n\nnuget.org requires a registered certificate thumbprint. Azure Artifact\nSigning certs rotate ~72h, so Gallery validation rejects them. Use\nci-github-actions/code-signing + jsign DIGICERTONE (stable DigiCert\nthumbprint already used for ot\n[…]\nnches; use smctl\n\n- Skip DigiCert setup/sign on pull_request (quota; matches .NET practice).\n- Sign via smctl + jsign PKCS11 instead of DIGICERTONE REST (keypair\n fetch returned non-JSON HTML in CI).",
"is_bot": false,
"headline": "PREQ-7434 Sign NuGet packages with DigiCert instead of Azure (#465)",
"author_name": "tomverin",
"author_login": "tomverin",
"committed_at": "2026-07-22T13:56:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d680827a64cd61d8fa888a364ef4140e760702e1",
"body": "MuleSoft Mule config XML namespaces (http://www.mulesoft.org/schema/mule/*)\nare opaque identifiers, not real cleartext connections.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add MuleSoft schema host to cleartext namespace URI authorities (#458)",
"author_name": "Teemu R.",
"author_login": "teemu-rytilahti-sonarsource",
"committed_at": "2026-07-22T11:54:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d1e02f4f44a93985a09d1785857c13085ef3d7dc",
"body": "Adds regex p[@a]ssw[o0]rd to identify common leetspeak variants of \"password\".",
"is_bot": false,
"headline": "secretclassifier: filter leetspeak passw0rd variants (#459)",
"author_name": "Teemu R.",
"author_login": "teemu-rytilahti-sonarsource",
"committed_at": "2026-07-22T11:53:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c235e941153f5d8c97cffef250fef5fef6ae27f7",
"body": "nuget.org rejects the package with 400 unless licenseUrl matches the\nlicense expression (https://licenses.nuget.org/LGPL-3.0-only).",
"is_bot": false,
"headline": "PREQ-7434 Set NuGet licenseUrl for LGPL-3.0-only expression (#463)",
"author_name": "tomverin",
"author_login": "tomverin",
"committed_at": "2026-07-22T09:51:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "79ae2f9a81e48ca1441823c185b3faf5cc1c9fcb",
"body": "* PREQ-7435 Run publish jobs when release is skipped\n\nGitHub Actions skips jobs that transitively depend on a skipped job unless\nthey have an explicit if. After publishPackagesOnly skipped release, promote\nsucceeded but npm/NuGet publish never ran.\n\n* PREQ-7435 Fix npm publish path interpreted as gi\n[…]\nnticate\nwith the Vault npmjs token for the bootstrap publish to registry.npmjs.org.\n\n* PREQ-7435 Do not put comments inside vault-action secrets block\n\nComments were parsed as secret paths (DENIED #).",
"is_bot": false,
"headline": "PREQ-7435 Run publish jobs when release is skipped (#462)",
"author_name": "tomverin",
"author_login": "tomverin",
"committed_at": "2026-07-22T09:44:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5cd5033dfa980728c98cd7c029846381b4d8e2f7",
"body": "…461)\n\n* PREQ-7435 Fix release promote/publish version on workflow_dispatch\n\nPromote and public-registry jobs only read github.event.release.tag_name,\nso workflow_dispatch runs left RELEASE_VERSION empty and build-promote\nfailed with 405. Use the same inputs.version fallback as the main release job.\n[…]\ninaries release\n\nAllow workflow_dispatch to promote and publish npm/NuGet without re-running\ngh-action_release, so a partial retry after Maven Central already succeeded\ndoes not redo the full release.",
"is_bot": false,
"headline": "PREQ-7435 Fix release promote/publish version on workflow_dispatch (#…",
"author_name": "tomverin",
"author_login": "tomverin",
"committed_at": "2026-07-22T09:11:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "78da1a3a2d0f32812f6d8d6a05df5d5d98074396",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-100 Publish Nuget and npm artifact to public repository (#457)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2026-07-21T09:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eeae95eb3ab53f1ded5f144e29c338be1664ea04",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update dependency jdx/mise to v2026 (#455)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-21T08:43:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cee5742515888b8af111bb13462490778790466d",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.29 (#450)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-20T06:39:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "87564d754d086477cee5cb9cabca91e448603314",
"body": "* Update dependency xml-apis:xml-apis to v1.4.01\n\n* Remove redundant xml-apis dependency\n\n---------\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Victor Diez <victor.diez@sonarsource.com>",
"is_bot": true,
"headline": "Remove redundant xml-apis dependency (#452)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T20:52:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffaec27091f31a06bbaac5f2792d8b886bacc8d7",
"body": "…451)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Replace dependency xml-apis:xml-apis with xml-apis:xml-apis 1.0.b2 (#…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T20:29:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a3db5ebc4b95e3031f20be65912c448bb7d0ed7",
"body": "* Update dependency org.snakeyaml:snakeyaml-engine to v3\n\n* ACOMMONS-92 Handle nullable SnakeYAML comments\n\n---------\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Victor Diez <victor.diez@sonarsource.com>",
"is_bot": true,
"headline": "Update dependency org.snakeyaml:snakeyaml-engine to v3 (#446)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T15:24:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1be3b9cc40f2d77571f56b113cccac67d253905",
"body": "* Update dependency com.fasterxml.woodstox:woodstox-core to v7\n\n* ACOMMONS-90 Update XML location test for Woodstox fix\n\n---------\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Victor Diez <victor.diez@sonarsource.com>",
"is_bot": true,
"headline": "Update dependency com.fasterxml.woodstox:woodstox-core to v7 (#444)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T15:23:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d1401350791b75b37676453401f2c4378a21c7ed",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update jdx/mise-action action to v4 (#448)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:55:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1df787d1bd855e61dc9619ee0ddd17d5da6bdd76",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update dependency org.slf4j:slf4j-api to v1.7.36 (#442)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:54:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e95b888e757e8b45f6aa8e7d830537a3a66cce9",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update actions/checkout action to v7 (#443)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:54:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3fd4c33ddf62e41d162d0cc27531f07959527cea",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update dependency org.junit:junit-bom to v6 (#445)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:54:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "04e653d076d4bff7f494b722aa2180ae60b6ca94",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update dependency xml-apis:xml-apis to v2 (#447)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:54:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3b0d6c5878a12ad8aa0cce1995d4c4e379021f5",
"body": null,
"is_bot": false,
"headline": "Fix Next quality gate",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-17T14:53:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "616b129935e3d767fac1302364b0f3d2afc9a30d",
"body": null,
"is_bot": false,
"headline": "CLP-212 Migrate scanner test fixtures (#441)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-17T13:55:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d346523c7211fd8ddb056a2b566653a1327ae3d7",
"body": "…cript friendly (#439)",
"is_bot": false,
"headline": "ACOMMONS-86 Improve regexes exposed from SecretClassifier to be JavaS…",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2026-07-17T07:18:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c70f237bd054880e42839515ff146b66150c81dd",
"body": null,
"is_bot": false,
"headline": "Fix Next quality gate (#440)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-16T06:20:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e50e29f40342f5f49ffad569216dbda55213f45",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Update dependency org.codehaus.mojo:exec-maven-plugin to v3.6.3 (#438)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-15T15:30:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "71a9992bd12e5f2d81a9a65b3ed85b46c96d6a22",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-78 Expose the regexes from SecretClassifier as JSON file (#426)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2026-07-15T12:37:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b979fe3cca64fe4844a70180207a7309569d7eb",
"body": "* Bump Mockito to 5.23.0 and JUnit Jupiter to 5.14.3 in pom.xml\n\n* Bump annotations to 26.1.0 and Gson to 2.14.0 in pom.xml files\n\n* Bump sonar.plugin.api version to 13.9.0.4417 in pom.xml\n\n* Revert sonar.plugin.api version to 13.5.0.4319 in pom.xml\n\n* Bump sonar.plugin.api version to 13.8.0.4399 and update JUnit Jupiter to 5.14.4 in pom.xml",
"is_bot": false,
"headline": "ACOMMONS-67 Bump version of dependencies (#434)",
"author_name": "Mallow",
"author_login": "mallory-scotton",
"committed_at": "2026-07-14T12:33:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48c8e06b1f09751cd9c8aedd152df7892470530e",
"body": "…rns (#436)\n\nCo-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ACOMMONS-83 Add **/Test/** and **/Tests/** to default test file patte…",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-14T11:41:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "12b2a511b96b05893f8579b54e043ad7d0a5ccad",
"body": null,
"is_bot": false,
"headline": "CLP-204 Update PM email in automated release workflow",
"author_name": "Aurélien Coet",
"author_login": "aurelien-coet-sonarsource",
"committed_at": "2026-07-14T10:03:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd661df949e8063f07b1158671e8027d5664ddcf",
"body": "…ng mode (#433)\n\n* ACOMMONS-4 Preserve whitespace inside character classes in free-spacing mode\n\nWhitespace and comments should not be stripped inside [...] character\nclasses when the comment/extended flag is active, per PCRE-style /x\nsemantics. RegexLexer was stripping them everywhere, causing\nSing\n[…]\nd. Disable free-spacing\nmode before reading '[' so the buffer reset rewinds far enough back\nto preserve that whitespace as a literal character.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ACOMMONS-4 Preserve whitespace inside character classes in free-spaci…",
"author_name": "Mallow",
"author_login": "mallory-scotton",
"committed_at": "2026-07-13T14:29:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5ddf29e7b4d1d9ca85bce502b81ba9a1e77aba3d",
"body": "…ped characters (#431)",
"is_bot": false,
"headline": "ACOMMONS-3 Add regression tests for character class parsing with esca…",
"author_name": "Mallow",
"author_login": "mallory-scotton",
"committed_at": "2026-07-13T14:18:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0266e63c4800cedff1f9c1f99547838b269b13d8",
"body": "…tation \"org.sonar.check.Rule\" (#432)\n\n* Enhance RuleMetadataLoader to handle missing resource folder scenario\n\n* Add tests for loading rules from annotations without resource folder\n\n* Update README to clarify RuleMetadataLoader functionality with annotations",
"is_bot": false,
"headline": "ACOMMONS-1 RuleMetadataLoader ignores fields other than \"key\" of anno…",
"author_name": "Mallow",
"author_login": "mallory-scotton",
"committed_at": "2026-07-13T14:01:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce5ff98ade7728d7bcd4b0db86a1f1ffeff1452a",
"body": null,
"is_bot": false,
"headline": "Add automated release workflow (#401)",
"author_name": "Nils Werner",
"author_login": "nils-werner-sonarsource",
"committed_at": "2026-07-10T07:07:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "125bf4018cebdf8bc800abe9caf60091fdf87d1a",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-82 Make use of features available after Java upgrade (#430)",
"author_name": "Felix Pauck",
"author_login": "felix-pauck-sonarsource",
"committed_at": "2026-07-09T12:08:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58301e29bc855a219300ce612a72b6af9e43308d",
"body": null,
"is_bot": false,
"headline": "CLP-156 Switch Renovate preset to quality-corelang-squad (#429)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-09T07:11:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "277d147a1dc5e7ce050a5cc2623ae53cc34c21f5",
"body": null,
"is_bot": false,
"headline": "CLP-129 Normalize Jira automation workflows (#425)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-08T12:29:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "867b2ece6a70ea2d03eea61e84b48776c0938b1b",
"body": null,
"is_bot": false,
"headline": "Update Java to 17 (#427)",
"author_name": "Felix Pauck",
"author_login": "felix-pauck-sonarsource",
"committed_at": "2026-07-08T09:14:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c89eb33dec69ac201f5121ece7f9923d7527e4a7",
"body": null,
"is_bot": false,
"headline": "Prepare for next development iteration (#428)",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-08T09:14:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "66a5dac88439738e285a695cee797646d501750d",
"body": "Add TestFileClassifier to org.sonarsource.analyzer.commons.appsec: a\npath heuristic that lets rules treat files as tests when the project\nhas not declared its test sources. It is a no-op whenever sonar.tests\nis set, so it never overrides an intentional project configuration.\n\n- Ant-glob matching on \n[…]\n\n- Warns once when the heuristic first fires, via an AtomicBoolean so\n the message is logged exactly once under parallel analysis\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ACOMMONS-71 Add TestFileClassifier to analyzer-commons (#424)",
"author_name": "Teemu R.",
"author_login": "teemu-rytilahti-sonarsource",
"committed_at": "2026-07-06T12:58:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5dbbd17746bfdd9527417b5d8a0fb07eaf7728b4",
"body": null,
"is_bot": false,
"headline": "CLP-64 Add the ToggleLockBranch GH workflow (#406)",
"author_name": "Aurélien Coet",
"author_login": "aurelien-coet-sonarsource",
"committed_at": "2026-07-06T11:42:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f0ab0bab43029785493f7fab2f32d05625810b6",
"body": "…er pattern (#422)\n\nAdds ^__.+__$ to the PLACEHOLDER pattern group in SecretClassifier to recognize double-underscore-wrapped values like __some_placeholder_password__ as non-secrets. This pattern is commonly used as a placeholder convention in config files.\n\nAlso, test improve the tests by testing patterns by category to make sure every pattern is exercised properly.",
"is_bot": false,
"headline": "APPSEC-3475 SecretClassifier: Add double-underscore-wrapped placehold…",
"author_name": "Teemu R.",
"author_login": "teemu-rytilahti-sonarsource",
"committed_at": "2026-07-03T14:34:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b0f61869acf94f843fcbd1e7297dad083f9eb08a",
"body": null,
"is_bot": false,
"headline": "Prepare for next development iteration (#423)",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-03T11:27:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf6127100c966cd7d521824ccf746373b464077a",
"body": "…g filters (#418)\n\n* Add secret, admin, and pass to substring filters\n\n* Apply feedback\n\n* Improve test",
"is_bot": false,
"headline": "ACOMMONS-72 SecretClassifier: Add secret, admin, and pass to substrin…",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-03T09:03:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "faa8047f93eff4b7b15869d4a465353304d13bfa",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-60 Use squad Renovate preset (#413)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-07-02T09:10:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1fcf66c5b69f1428c5816b407495b663072a79a1",
"body": null,
"is_bot": false,
"headline": "Prepare for next development iteration (#416)",
"author_name": "Nils Werner",
"author_login": "nils-werner-sonarsource",
"committed_at": "2026-07-01T14:57:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7614ef23ecbd37c6320c488d472a292db0d5b175",
"body": null,
"is_bot": false,
"headline": "Update assertj to version 3.27.7 (#415)",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-01T13:10:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e79e17aa51a46e40c7c2f8af6ddeff07c3acbf47",
"body": null,
"is_bot": false,
"headline": "filter our empty passwords (#414)",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-01T12:43:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74f1351ef4c0ecc2f051be4b4927431c153755b4",
"body": "* SONARIAC-3020: Add SecretClassifier to the appsec package\n\nPort of the SecretClassifier from sonar-iac-enterprise (PR #1092) to\nsonar-analyzer-commons so other analyzers can reuse it without taking a\ndependency on sonar-iac.\n\n- Categories: FAKE_VALUE, SECRET (exact-match), PLACEHOLDER, ENCRYPTED,\n\n[…]\n<teemu.rytilahti@sonarsource.com>\n\n* Apply feedback\n\n---------\n\nCo-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com>\nCo-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "SONARIAC-3020: Add SecretClassifier to the appsec package (#411)",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-07-01T12:30:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bd732a0d69539a1a16629bd7d97c619180b1c279",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Add renovate.json (#407)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-01T09:50:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31684beb0c5c29ec3e46753d92e5467ba4b1a21b",
"body": null,
"is_bot": false,
"headline": "CLP-102 Update notifications Slack channels (#408)",
"author_name": "Aurélien Coet",
"author_login": "aurelien-coet-sonarsource",
"committed_at": "2026-06-30T12:31:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "05c98a9e277b6613c5c4ca111247a5e234577aa3",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-59 Add NOTICE.txt file (#405)",
"author_name": "Guillaume Dequenne",
"author_login": "guillaume-dequenne",
"committed_at": "2026-06-19T15:17:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a463bb17e8317c001afee5366bb9395315ba9464",
"body": "(cherry picked from commit 2443a9beba52ffc184d34ffd08e6000d1aeb970e)\n\nCo-authored-by: Jonah Jeleniewski <jjeleniewski@integradev.com.au>",
"is_bot": false,
"headline": "Allow dashes in `sonar-resolve` rule keys (#404)",
"author_name": "Victor",
"author_login": "vdiez",
"committed_at": "2026-06-19T09:57:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f3750c7d025e6a71765f3e436bfc24785e3ae77f",
"body": null,
"is_bot": false,
"headline": "Move repository ownership to Core Languages and Parsers (#403)",
"author_name": "Aurélien Coet",
"author_login": "aurelien-coet-sonarsource",
"committed_at": "2026-06-19T09:21:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "703317ec1d3921987e38d0eca48f4d4f8e5fd6b2",
"body": null,
"is_bot": false,
"headline": "Prepare for next development iteration (#402)",
"author_name": "Guillaume Dequenne",
"author_login": "guillaume-dequenne",
"committed_at": "2026-06-15T14:30:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "471e0f2cfee6c87aa4d0c19a55e008ef46ba4a46",
"body": "* APPSEC-3390: Add shared IpAddressClassifier to the appsec package\n\nAdds an IANA-aligned IPv4/IPv6 reserved-range oracle as a shared utility\nfor analyzers consuming analyzer-commons. Useful for S1313 (hardcoded\nIP), S6329 (public network access), S6321 (admin-services-exposed), and\nsimilar appsec r\n[…]\nnyAddress, isBroadcast, and\n isUnrestrictedCidr.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "APPSEC-3390: Add shared IpAddressClassifier to the appsec package (#400)",
"author_name": "Teemu R.",
"author_login": "teemu-rytilahti-sonarsource",
"committed_at": "2026-06-15T08:52:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "476a4170499d1b5b8b8512cbbaf6ed9b4d3b8c60",
"body": "…ug, widen IPv4 loopback (#399)\n\n* APPSEC-3388: Add namespace URI authorities, fix bare-scheme bug, widen IPv4 loopback\n\n- Add 10 missing namespace URI authorities to NAMESPACE_URI_AUTHORITIES\n (xml.apache.org, schemas.openxmlformats.org, rdfs.org, schemas.google.com,\n a9.com, ns.adobe.com, ltsc.\n[…]\n88: Hoist toLowerCase out of noneMatch lambda\n\nCo-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "APPSEC-3388: Add missing namespace URI authorities, fix bare-scheme b…",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-06-12T12:02:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "307791c45426ee33bdf3315403024dc69531257b",
"body": "…ls() in CleartextProtocolFilter (#398)\n\n* APPSEC-3389: Expose getCleartextProtocols() and getAlternativeProtocols() in CleartextProtocolFilter\n\nCo-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>\n\n* APPSEC-3389: Fix S5778 - extract collection before assertThatExceptionOfType lamb\n[…]\ntripped before\n passing to getIssueMessage()\n\nCo-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "APPSEC-3389: Expose getCleartextProtocols() and getAlternativeProtoco…",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-06-12T10:18:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "35871e6859eb247e64cb5775512bcac98fffa257",
"body": null,
"is_bot": false,
"headline": "Prepare for next development iteration (#397)",
"author_name": "Guillaume Dequenne",
"author_login": "guillaume-dequenne",
"committed_at": "2026-06-10T15:25:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b6fc51aa603b04ac03670467d46c5ab5e21c6d09",
"body": null,
"is_bot": false,
"headline": "Fix SonarQube issues (#396)",
"author_name": "Guillaume Dequenne",
"author_login": "guillaume-dequenne",
"committed_at": "2026-06-10T12:50:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e9eb093b2bbdf615d84ade6714f700aacde5d9b",
"body": "… (#395)\n\n* APPSEC-3185: Add CleartextProtocolFilter for S5332 safe-URL detection\n\nCentralises the logic for determining whether a cleartext-protocol URL\nshould suppress a S5332 finding. Covers two categories of safe URLs:\n\n- Internal hosts: loopback (IPv4/IPv6), AWS/GCP IMDS endpoints,\n Docker-int\n[…]\nly feedback\n\n* Apply bot feedback\n\n* Add more clear text protocols\n\n* Increase allowed JAR size\n\n* Adjust the maxsize\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "APPSEC-3359: Add CleartextProtocolFilter for S5332 safe-URL detection…",
"author_name": "Daniel Teuchert",
"author_login": "daniel-teuchert-sonarsource",
"committed_at": "2026-06-09T13:51:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "565d92cd94761e873c4f8447b46175192b9c86f2",
"body": null,
"is_bot": false,
"headline": "BUILD-10765 Update release action to v6 (#390)",
"author_name": "SonarTech",
"author_login": "SonarTech",
"committed_at": "2026-04-29T13:02:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c3b68d346c5c8bc3bbda314639bc8df2c23a199",
"body": null,
"is_bot": false,
"headline": "SubmitReview: Use Vault token (#393)",
"author_name": "Pavel Mikula",
"author_login": "pavel-mikula-sonarsource",
"committed_at": "2026-04-28T16:55:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07a6e2798a811e3672abcda5e61a97e99a5de05d",
"body": null,
"is_bot": false,
"headline": "Prepare next iteration",
"author_name": "Mostafa Mohammed",
"author_login": "mostafa-mohammed-sonarsource",
"committed_at": "2026-04-20T12:40:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3cbc542f8cb9fedecb7d83edbf034cdc76674e11",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-48 Update parent pom to 87.0.0.3057 and update license headers",
"author_name": "Mostafa Mohammed",
"author_login": "mostafa-mohammed-sonarsource",
"committed_at": "2026-04-17T14:20:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f04f48d172179e02c87eebaa33d42265ecb8307",
"body": "…(#386)\n\n* BUILD-10765 Important: Update SonarSource/gh-action_release to 6.5.0\n\n* Update .github/workflows/release.yml\n\nCo-authored-by: Mostafa Mohammed <mostafa.mohammed@sonarsource.com>\n\n---------\n\nCo-authored-by: mikolaj-matuszny-ext-sonarsource <mikolaj.matuszny.ext@sonarsource.com>\nCo-authored-by: Mostafa Mohammed <mostafa.mohammed@sonarsource.com>",
"is_bot": false,
"headline": "BUILD-10765 Important: Update SonarSource/gh-action_release to 6.7.0 …",
"author_name": "SonarTech",
"author_login": "SonarTech",
"committed_at": "2026-04-14T10:47:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5dd8cd475652a993bbc0f1567ade051878d7b304",
"body": "* CPP-7789 Add shared SonarResolve parser to analyzer commons\n\n* CPP-7789 Adjust analyzer commons artifact size bounds\n\n* CPP-7789 Remove unnecessary visibility from SonarResolveTest\n\n* CPP-7789 Prepare SonarResolve line model for future offsets\n\n* CPP-7789 Rename SonarResolve Driver to StreamingPar\n[…]\ntor usage\n\n* CPP-7902 Support multiple justification delimiters in SonarResolve\n\n* CPP-7902 Support multiple justification delimiters in SonarResolve\n\n* CPP-7902 Fix SonarResolveTest constructor usage",
"is_bot": false,
"headline": "CPP-7789 Add shared SonarResolve parser to analyzer commons",
"author_name": "Mostafa Mohammed",
"author_login": "mostafa-mohammed-sonarsource",
"committed_at": "2026-04-14T09:35:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "999efc9da1d513c5994cf2976970fed1691cc66e",
"body": null,
"is_bot": false,
"headline": "BUILD-10765 Update gh-action_release to v6.4.0 (#384)",
"author_name": "mikolaj-matuszny-ext-sonarsource",
"author_login": "mikolaj-matuszny-ext-sonarsource",
"committed_at": "2026-03-20T15:18:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c1218f7b4737f6ea56819d08d1a35f4fa5d6cf6",
"body": null,
"is_bot": false,
"headline": "Prepare for next development iteration",
"author_name": "Michael Gumowski",
"author_login": "Wohops",
"committed_at": "2025-12-03T09:03:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ca97ff347a4849367f2726a095d7e90b2a88d67",
"body": null,
"is_bot": false,
"headline": "Update pom.xml (#380)",
"author_name": "Nils Werner",
"author_login": "nils-werner-sonarsource",
"committed_at": "2025-12-02T16:40:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b78d8070ad2e618e9411cf15748ca3a55a44dfac",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-43 Prepare next iteration (#379)",
"author_name": "Gabriel Fleischer",
"author_login": "GabrielFleischer",
"committed_at": "2025-11-20T11:09:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d10d3f500a85f3777f124852b0990fb099992b8",
"body": null,
"is_bot": false,
"headline": "Update build-maven version (#378)",
"author_name": "Gabriel Fleischer",
"author_login": "GabrielFleischer",
"committed_at": "2025-11-19T15:14:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e139177dab5015a1e3b5ea92ca6d6c40bd366409",
"body": "* ACOMMONS-41 Use latest parent POM\n\n* ACOMMONS-41 Update license header",
"is_bot": false,
"headline": "ACOMMONS-41 Update License Header (#377)",
"author_name": "Gabriel Fleischer",
"author_login": "GabrielFleischer",
"committed_at": "2025-11-19T14:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "330d9cd096685a8bf6564d8ab3637a7dc33146cd",
"body": "* SONARXML-168 Configure XML parser to handle large attributes",
"is_bot": false,
"headline": "SONARXML-168 Configure XML parser to handle large attributes (#376)",
"author_name": "Gabriel Fleischer",
"author_login": "GabrielFleischer",
"committed_at": "2025-11-19T09:11:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95d60a2f0a42de72275c1e55b6e8eb46c504331d",
"body": "…ine (#373)",
"is_bot": false,
"headline": "ACOMMONS-38 Add GitHub Actions build workflow and remove Cirrus pipel…",
"author_name": "Nils Werner",
"author_login": "nils-werner-sonarsource",
"committed_at": "2025-11-06T10:07:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b20cefec6a5bb07ddd7064968fd219093f0fadb",
"body": null,
"is_bot": false,
"headline": "Prepare next development iteration",
"author_name": "Nicolas Gauthier",
"author_login": "nicolas-gauthier-sonarsource",
"committed_at": "2025-11-03T14:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f8afc079e1d40c0a506a2aac04e771e414b8ea3",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-35 Remove commons-lang dependency",
"author_name": "nicolas-gauthier-sonarsource",
"author_login": "nicolas-gauthier-sonarsource",
"committed_at": "2025-10-31T12:57:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ddf4a1b0304ed4a9ec2dd607a0a488f195da5386",
"body": "…, ASVS 5.0, STIG ASD_V6, MASVS 2 metadata (#370)",
"is_bot": false,
"headline": "ACOMMONS-34 Expose Standards OWASP LLM Top 10 2025, OWASP Top 10 2025…",
"author_name": "nicolas-gauthier-sonarsource",
"author_login": "nicolas-gauthier-sonarsource",
"committed_at": "2025-10-30T15:53:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d9d05b563cf6930476c6590f71e2c76316403d9",
"body": null,
"is_bot": false,
"headline": "BUILD-8875 Update GitHub Actions runners to new naming convention",
"author_name": "SonarTech",
"author_login": "SonarTech",
"committed_at": "2025-09-29T12:28:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09f3cd8fba43e9d2dbef4dabda393993806ebbfc",
"body": null,
"is_bot": false,
"headline": "Prepare next development iteration",
"author_name": "Evgeny Mandrikov",
"author_login": "Godin",
"committed_at": "2025-09-26T14:59:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a591f4796d7f732387b9b8a091b8bf1e5fc55974",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-27 OWASP Mobile Top 10 2024",
"author_name": "Evgeny Mandrikov",
"author_login": "Godin",
"committed_at": "2025-05-23T09:19:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "053b7990b5dde3bda5da6f4c56d432a799a95562",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-32 Update sonar-plugin-api dependency to 11.4.0.2922",
"author_name": "Evgeny Mandrikov",
"author_login": "Godin",
"committed_at": "2025-05-23T09:19:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d15aa0064b14b849a0ffae163f3d4ef56e00789",
"body": null,
"is_bot": false,
"headline": "BUILD-8073 Migrate public repositories workflows to large runners",
"author_name": "Samir M",
"author_login": "SamirM-BE",
"committed_at": "2025-05-15T09:47:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a36b1528bf309d647eaf02f4a692259201d116d",
"body": null,
"is_bot": false,
"headline": "Prepare next development iteration (#364)",
"author_name": "Ilia Kebets",
"author_login": "kebetsi",
"committed_at": "2025-04-01T12:40:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a381a545916602c59d3bef678d6ce0ff47c1a614",
"body": null,
"is_bot": false,
"headline": "bump license header to 2025",
"author_name": "Ilia Kebets",
"author_login": "kebetsi",
"committed_at": "2025-04-01T12:05:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1a2e25384c2b40772c34e937ecade895475eaa27",
"body": null,
"is_bot": false,
"headline": "Update parent pom",
"author_name": "Ilia Kebets",
"author_login": "kebetsi",
"committed_at": "2025-04-01T12:05:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ebf99408bba0a680f4e1553635eca2d5a3f71c8",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-26 Add missing package-info.java for quality gate (#362)",
"author_name": "Romain Brenguier",
"author_login": "romainbrenguier",
"committed_at": "2025-03-19T08:41:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e00ded3ca5000bc779763d0adc2b26ac34430fef",
"body": "… data instead of file paths (#361)",
"is_bot": false,
"headline": "ACOMMONS-24 - Add a way to execute RuleMetadataLoader with structured…",
"author_name": "Eric Morand",
"author_login": "ericmorand-sonarsource",
"committed_at": "2025-03-12T16:42:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c44ef68806f8e7c9b72c666da58e06ac6f7b688",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-23 Autoclose issues created by Jira integration (#360)",
"author_name": "Pavel Mikula",
"author_login": "pavel-mikula-sonarsource",
"committed_at": "2025-03-06T16:09:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c690156eb68e0ddea575c9615af6bb057ac0580",
"body": "…lity-team (#359)",
"is_bot": false,
"headline": "Update CODEOWNERS from @SonarSource/analysis-team to @SonarSource/qua…",
"author_name": "edward-gonzales-sonarsource",
"author_login": "edward-gonzales-sonarsource",
"committed_at": "2025-01-31T14:55:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7444f54caaa33beeef5fc50a7d201d23932df061",
"body": null,
"is_bot": false,
"headline": "ACOMMONS-20 Add Jira integration (#358)",
"author_name": "Pavel Mikula",
"author_login": "pavel-mikula-sonarsource",
"committed_at": "2024-12-11T09:57:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58f0c3922f11184af2812fcc670be0edad57b528",
"body": null,
"is_bot": false,
"headline": "Update cirrus-modules to v3 (#355)",
"author_name": "Johann Beleites",
"author_login": "johann-beleites-sonarsource",
"committed_at": "2024-11-19T15:41:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ebad78fcd10332bf767bb0f64d176f6b4ecb0bdb",
"body": null,
"is_bot": false,
"headline": "Prepare the next development iteration (#354)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2024-11-15T09:10:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6734ae8af3356675d54afb04f2282ddffcb3ab16",
"body": null,
"is_bot": false,
"headline": "Prepare the next development iteration (#353)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2024-11-14T14:44:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a727042847ef7ee2c3ade5ec77ab034542943c66",
"body": null,
"is_bot": false,
"headline": "Update parent pom (#352)",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2024-11-07T15:59:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "597418985c217a8479429759930ff97b2ed82a8a",
"body": "…commons (#351)\n\nSONARPHP-1555 Move helper classes for hard-coded secrets to analyzer commons",
"is_bot": false,
"headline": "SONARPHP-1555 Move helper classes for hard-coded secrets to analyzer …",
"author_name": "Marcin Stachniuk",
"author_login": "mstachniuk",
"committed_at": "2024-11-07T15:33:07Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 49,
"commits_last_year": 84,
"latest_release_at": "2026-07-23T08:31:54Z",
"latest_release_tag": "2.29.0.5138",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 16,
"days_since_latest_release": 2,
"mean_days_between_releases": 27.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 62,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "org.sonarsource.analyzer-commons:sonar-analyzer-commons",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-analyzer-commons",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 65,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:45Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:sonar-analyzer-recognizers",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-analyzer-recognizers",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 57,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:48Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:sonar-xml-parsing",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-xml-parsing",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 55,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:50Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:sonar-analyzer-test-commons",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-analyzer-test-commons",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 63,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:49Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:sonar-regex-parsing",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-regex-parsing",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 48,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:48Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:test-sonar-xml-parsing",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/test-sonar-xml-parsing",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 50,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:50Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:sonar-performance-measure",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-performance-measure",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 45,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:47Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
},
{
"name": "org.sonarsource.analyzer-commons:sonar-analyzer-commons-configurations",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "maven",
"matches_repo": null,
"registry_url": "https://central.sonatype.com/artifact/org.sonarsource.analyzer-commons/sonar-analyzer-commons-configurations",
"is_deprecated": false,
"latest_version": "2.29.0.5138",
"repository_url": null,
"versions_count": 4,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:43:49Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
}
]
},
"popularity": {
"forks": 14,
"stars": 28,
"watchers": 25,
"fork_history": {
"days": [
{
"date": "2017-10-14",
"count": 1
},
{
"date": "2018-12-24",
"count": 1
},
{
"date": "2019-04-21",
"count": 1
},
{
"date": "2019-07-25",
"count": 1
},
{
"date": "2022-01-20",
"count": 1
},
{
"date": "2022-05-24",
"count": 1
},
{
"date": "2022-08-19",
"count": 1
},
{
"date": "2022-12-29",
"count": 1
},
{
"date": "2024-09-24",
"count": 1
},
{
"date": "2024-11-21",
"count": 1
},
{
"date": "2025-03-12",
"count": 2
},
{
"date": "2025-11-05",
"count": 1
},
{
"date": "2026-06-01",
"count": 1
}
],
"complete": true,
"collected": 14,
"total_forks": 14
},
"star_history": null,
"open_issues_and_prs": 6
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"mise.toml"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"commons/pom.xml",
"performance-measure/pom.xml",
"pom.xml",
"recognizers/pom.xml",
"regex-parsing/pom.xml",
"sonar-analyzer-commons-configurations/pom.xml",
"test-commons/pom.xml",
"test-xml-parsing/pom.xml",
"xml-parsing/pom.xml"
],
"largest_source_bytes": 47661,
"source_files_sampled": 356,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"commons/pom.xml",
"performance-measure/pom.xml",
"pom.xml",
"recognizers/pom.xml",
"regex-parsing/pom.xml",
"sonar-analyzer-commons-configurations/pom.xml",
"test-commons/pom.xml",
"test-xml-parsing/pom.xml",
"xml-parsing/pom.xml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 3,
"malicious_count": 0,
"assessed_package": "maven:org.sonarsource.analyzer-commons:sonar-analyzer-commons@2.29.0.5138",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"maven"
],
"dependencies": [
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "commons/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "com.googlecode.json-simple:json-simple",
"manifest": "commons/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "performance-measure/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "com.google.code.gson:gson",
"manifest": "performance-measure/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "org.sonarsource.scanner.engine:plugin-api-scanner-impl",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.sonar.scanner}"
},
{
"name": "org.sonarsource.scanner.engine:sensor-test-fixtures",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.sonar.scanner}"
},
{
"name": "org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.sonar.plugin.api}"
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.jsr305}"
},
{
"name": "com.googlecode.json-simple:json-simple",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "1.1.1"
},
{
"name": "com.google.code.gson:gson",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.gson}"
},
{
"name": "junit:junit",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.junit}"
},
{
"name": "org.junit:junit-bom",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.junit-jupiter}"
},
{
"name": "org.assertj:assertj-core",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.assertj}"
},
{
"name": "org.mockito:mockito-core",
"manifest": "pom.xml",
"ecosystem": "maven",
"version_constraint": "${version.mockito}"
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "recognizers/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "regex-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "org.sonarsource.analyzer-commons:sonar-analyzer-commons",
"manifest": "sonar-analyzer-commons-configurations/pom.xml",
"ecosystem": "maven",
"version_constraint": "${project.version}"
},
{
"name": "com.google.code.gson:gson",
"manifest": "sonar-analyzer-commons-configurations/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "test-commons/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "junit:junit",
"manifest": "test-commons/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "org.sonarsource.scanner.engine:plugin-api-scanner-impl",
"manifest": "test-xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "org.sonarsource.scanner.engine:sensor-test-fixtures",
"manifest": "test-xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "test-xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "org.sonarsource.analyzer-commons:sonar-xml-parsing",
"manifest": "test-xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": "${project.version}"
},
{
"name": "org.sonarsource.analyzer-commons:sonar-analyzer-test-commons",
"manifest": "test-xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": "${project.version}"
},
{
"name": "com.google.code.findbugs:jsr305",
"manifest": "xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": null
},
{
"name": "xerces:xercesImpl",
"manifest": "xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": "2.12.2"
},
{
"name": "com.fasterxml.woodstox:woodstox-core",
"manifest": "xml-parsing/pom.xml",
"ecosystem": "maven",
"version_constraint": "7.2.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 5,
"merged_prs": 351,
"open_issues": 1,
"closed_ratio": 0.987,
"closed_issues": 75,
"closed_unmerged_prs": 42
},
"bus_factor": 8,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "Wohops",
"commits": 51,
"avatar_url": "https://avatars.githubusercontent.com/u/744276?v=4"
},
{
"type": "User",
"login": "alban-auzeill",
"commits": 36,
"avatar_url": "https://avatars.githubusercontent.com/u/1235009?v=4"
},
{
"type": "User",
"login": "vilchik-elena",
"commits": 27,
"avatar_url": "https://avatars.githubusercontent.com/u/10108186?v=4"
},
{
"type": "User",
"login": "nils-werner-sonarsource",
"commits": 24,
"avatar_url": "https://avatars.githubusercontent.com/u/64034005?v=4"
},
{
"type": "User",
"login": "saberduck",
"commits": 15,
"avatar_url": "https://avatars.githubusercontent.com/u/680437?v=4"
},
{
"type": "User",
"login": "christophe-zurn-sonarsource",
"commits": 15,
"avatar_url": "https://avatars.githubusercontent.com/u/36889251?v=4"
},
{
"type": "User",
"login": "tomverin",
"commits": 11,
"avatar_url": "https://avatars.githubusercontent.com/u/532027?v=4"
},
{
"type": "User",
"login": "quentin-jaquier-sonarsource",
"commits": 11,
"avatar_url": "https://avatars.githubusercontent.com/u/43733433?v=4"
},
{
"type": "User",
"login": "guillaume-dequenne",
"commits": 11,
"avatar_url": "https://avatars.githubusercontent.com/u/54781802?v=4"
},
{
"type": "User",
"login": "daniel-teuchert-sonarsource",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/141642369?v=4"
}
],
"contributors_sampled": 59,
"top_contributor_share": 0.136
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"PullRequestClosed.yml",
"PullRequestCreated.yml",
"RequestReview.yml",
"SubmitReview.yml",
"ToggleLockBranch.yml",
"automated-release.yml",
"build.yml",
"pr-cleanup.yml",
"release.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 5,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 13 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 2,
"reason": "dependency not pinned by hash detected -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 5,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "915b718d0675327a4e2df0cbd1f0caf3a6a13ca8",
"ran_at": "2026-07-25T19:08:35Z",
"aggregate_score": 7.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T06:49:33Z",
"oldest_open_prs": [
{
"number": 365,
"created_at": "2025-04-22T07:29:56Z",
"last_comment_at": "2025-04-22T08:08:40Z",
"last_comment_author": "sonarqube-next"
},
{
"number": 456,
"created_at": "2026-07-20T23:54:44Z",
"last_comment_at": "2026-07-20T23:55:04Z",
"last_comment_author": "hashicorp-vault-sonar-prod"
},
{
"number": 472,
"created_at": "2026-07-23T14:05:34Z",
"last_comment_at": "2026-07-23T14:11:45Z",
"last_comment_author": "sonarqube-next"
},
{
"number": 473,
"created_at": "2026-07-24T21:01:45Z",
"last_comment_at": "2026-07-24T21:03:37Z",
"last_comment_author": "sonarqube-next"
},
{
"number": 474,
"created_at": "2026-07-25T18:48:42Z",
"last_comment_at": "2026-07-25T18:50:47Z",
"last_comment_author": "sonarqube-next"
}
],
"last_merged_pr_at": "2026-07-23T17:29:04Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 412,
"created_at": "2026-07-01T09:58:51Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/SonarSource/sonar-analyzer-commons",
"host": "github.com",
"name": "sonar-analyzer-commons",
"owner": "SonarSource"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 74,
"inputs": {
"security": 80,
"vitality": 84,
"community": 48,
"governance": 92,
"engineering": 61
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 84,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 74,
"inputs": {
"commits_last_year": 84,
"human_commit_share": 0.85,
"days_since_last_push": 0,
"active_weeks_last_year": 16
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "16/52 weeks with commits",
"points": 11.1,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 16
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "84 commits in the last year",
"points": 17.3,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 84
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 49,
"latest_release_tag": "2.29.0.5138",
"releases_from_tags": false,
"days_since_latest_release": 2,
"mean_days_between_releases": 27.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "49 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 49
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~27.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 27.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 2,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 2 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 2
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 48,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"forks": 14,
"stars": 28,
"watchers": 25,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "28 stars",
"points": 23.2,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 28
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "14 forks",
"points": 9.3,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 14
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "25 watchers",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 25
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (LGPL-3.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "LGPL-3.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "excellent",
"name": "Sustainability & Governance",
"value": 92,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "excellent",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 97,
"inputs": {
"bus_factor": 8,
"contributors_sampled": 59,
"top_contributor_share": 0.136
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "8 contributor(s) cover half of all commits",
"points": 54,
"status": "met",
"details": [
{
"code": "bus_factor",
"params": {
"count": 8
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 14% of commits",
"points": 19.4,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 14
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "59 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 59
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 13 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 95,
"inputs": {
"merged_prs": 351,
"open_issues": 1,
"closed_issues": 75,
"issue_closed_ratio": 0.987,
"closed_unmerged_prs": 42
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "99% of issues closed",
"points": 46.1,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 99
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "351/393 decided PRs merged",
"points": 34.2,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 351,
"decided": 393
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"followers": 1189,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "SonarSource",
"public_repos": 256,
"account_age_days": 5681
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1,189 followers of SonarSource",
"points": 22.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1189,
"login": "SonarSource"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "256 public repos, account ~15 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 256
}
},
{
"code": "account_age_years",
"params": {
"years": 15
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"org.sonarsource.analyzer-commons:sonar-analyzer-commons",
"org.sonarsource.analyzer-commons:sonar-analyzer-recognizers",
"org.sonarsource.analyzer-commons:sonar-xml-parsing",
"org.sonarsource.analyzer-commons:sonar-analyzer-test-commons",
"org.sonarsource.analyzer-commons:sonar-regex-parsing",
"org.sonarsource.analyzer-commons:test-sonar-xml-parsing",
"org.sonarsource.analyzer-commons:sonar-performance-measure",
"org.sonarsource.analyzer-commons:sonar-analyzer-commons-configurations"
],
"ecosystems": "maven",
"any_deprecated": false,
"min_days_since_publish": 2
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "8 package(s) on maven",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 8,
"ecosystems": "maven"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 2 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 2
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "65 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 65
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 61,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "9 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 9
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [
"language-team"
],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "1 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 1
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "good",
"name": "Security",
"value": 80,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "good",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 75,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 7.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 3.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 13 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 2",
"points": 1,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 3.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the maven:org.sonarsource.analyzer-commons:sonar-analyzer-commons@2.29.0.5138 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "maven:org.sonarsource.analyzer-commons:sonar-analyzer-commons@2.29.0.5138",
"assessed": 3
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 3,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 3,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 5
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 65,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.765,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "65 of 85 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 65,
"sampled": 85
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 71,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"mise.toml"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.09,
"toolchain_manifests": [
"commons/pom.xml",
"performance-measure/pom.xml",
"pom.xml",
"recognizers/pom.xml",
"regex-parsing/pom.xml",
"sonar-analyzer-commons-configurations/pom.xml",
"test-commons/pom.xml",
"test-xml-parsing/pom.xml",
"xml-parsing/pom.xml"
],
"dependency_bot_commit_share": 0.15
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "mise.toml",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "mise.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Java (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Java"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "9 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 9,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "15 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 15,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 2",
"points": 2,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Java",
"largest_source_bytes": 47661,
"source_files_sampled": 356,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Java (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Java"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/356 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 356,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-25T19:09:03.070942Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/SonarSource/sonar-analyzer-commons.svg",
"full_name": "SonarSource/sonar-analyzer-commons",
"license_state": "standard",
"license_spdx": "LGPL-3.0"
}