公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-27 01:33 UTC
michaelpipkin / dependabot-agent
michaelpipkin/dependabot-agent 的健康指数为 100 分中的 52 分，处于「中等」区间。 其得分最高的类别是Vitality（74/100），最低的是Community & Adoption（32/100）。 最近一次更新在 6 天前。 近期的大部分工作由 1 位贡献者完成。
52
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
52
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | dependabot-agent | 1.0.2 | 2,659 | 20 | 6 天前 | dependabotoverridesnpmpnpmsecurityvulnerabilitiescli |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
74
开发活跃度
56中等
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 6 天前 |
| 2.8/36 | 提交节奏 — 52 周中有 4 周有提交 |
| 17.5/18 | 提交量 — 最近一年 87 次提交 |
| 0/10 | OpenSSF Scorecard：Maintained — project was created within the last 90 days. Please review its contents carefully |
所用输入
| commits_last_year | 87 |
| human_commit_share | 1 |
| days_since_last_push | 6 |
| active_weeks_last_year | 4 |
发布纪律
100优秀
评分方式
| 27/27 | 有发布版本 — 已发布 15 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 6 天前 |
| 27/27 | 发布节奏 — 约每 0.4 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 15 |
| latest_release_tag | v1.0.2 |
| releases_from_tags | 否 |
| days_since_latest_release | 6 |
| mean_days_between_releases | 0.4 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
32
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 1 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
50中等
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（MIT） |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
生态采用（下载量）
57中等
评分方式
| 45.7/80 | 月度下载量 — npm 合计每月 2,659 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | dependabot-agent |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 2,659 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
55
维护者韧性（巴士系数）
13危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 3/10 | OpenSSF Scorecard：Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
85优秀
评分方式
| 46.8/46.8 | 议题解决 — 100% 的议题已关闭 |
| 38.2/38.3 | PR 接受 — 已裁定的 PR 中 27/27 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/15 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 27 |
| open_issues | 0 |
| closed_issues | 4 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 0 |
所有权与托管责任
41存在风险
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 3.4/25 | 所有者影响力 — michaelpipkin 有 2 位关注者 |
| 19.6/25 | 既往记录 — 10 个公开仓库，账户约 12 年 |
所用输入
| followers | 2 |
| owner_type | User |
| is_verified | — |
| owner_login | michaelpipkin |
| public_repos | 10 |
| account_age_days | 4,672 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 6 天前 |
| 20/20 | 版本历史 — 20 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | dependabot-agent |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 6 |
工程质量
基础的工程与文档实践是否到位？
47
工程实践
52中等
评分方式
| 24/24 | CI 工作流 — 2 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 4/20 | OpenSSF Scorecard：CI-Tests — 3 out of 13 merged PRs checked by a CI test -- score normalized to 2 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
40存在风险
评分方式
| 30/30 | README |
| 0/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 0/10 | 仓库描述 |
| 0/10 | 主题标签 |
| 10/10 | Wiki |
所用输入
| topics | — |
| has_wiki | 是 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 否 |
| has_description | 否 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
49
安全态势
36存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 0.5/2.5 | CI-Tests — 3 out of 13 merged PRs checked by a CI test -- score normalized to 2 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/15 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 3.6 |
已排除计分（无数据或不适用）：signed_releases。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 25/25 | 间接依赖不含已知公告 — 没有间接依赖携带已知公告 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 2 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 npm:dependabot-agent@1.0.2 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 2 个软件包。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
57
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 87 次人类提交中有 70 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.805 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 10/10 | 已体现的代理实践 — 最近 87 次提交中有 44 次由代理编写或署名代理 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | pnpm-lock.yaml |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0.506 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 25 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 59,036 |
| source_files_sampled | 25 |
| oversized_source_files | 0 |
关键数据
1GitHub 星标
1贡献者
87最近 12 个月提交数
6距最近推送天数
15发布版本数
1巴士系数（bus factor）
0开放议题
npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
OpenSSF Scorecard 3.6 / 10
3.6综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 2 | CI-Tests | 3 out of 13 merged PRs checked by a CI test -- score normalized to 2 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/15 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
直接依赖 1
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | js-yaml | ^4.1.0 | package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
依赖安全公告 0
安装 npm:dependabot-agent@1.0.2 会引入 2 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。
没有已知公告影响已评估的依赖。
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 347,
"has_wiki": true,
"homepage": null,
"languages": {
"JavaScript": 1679,
"TypeScript": 220459
},
"pushed_at": "2026-07-20T14:57:09Z",
"created_at": "2026-06-22T01:52:03Z",
"owner_type": "User",
"updated_at": "2026-07-20T15:00:02Z",
"description": null,
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "pipsplit.com",
"name": "Michael Pipkin",
"type": "User",
"login": "michaelpipkin",
"company": "isolved",
"location": "Maryland/D.C.",
"followers": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/5658291?v=4",
"created_at": "2013-10-10T18:15:49Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 4672
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2026-07-20T14:57:09Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-07-17T00:31:50Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-07-17T00:04:50Z"
},
{
"tag": "v0.1.16",
"kind": "patch",
"published_at": "2026-07-16T22:20:15Z"
},
{
"tag": "v0.1.15",
"kind": "patch",
"published_at": "2026-07-16T21:42:47Z"
},
{
"tag": "v0.1.14",
"kind": "patch",
"published_at": "2026-07-16T21:18:06Z"
},
{
"tag": "v0.1.13",
"kind": "patch",
"published_at": "2026-07-16T19:27:30Z"
},
{
"tag": "v0.1.12",
"kind": "patch",
"published_at": "2026-07-16T18:33:23Z"
},
{
"tag": "v0.1.11",
"kind": "patch",
"published_at": "2026-07-16T18:23:24Z"
},
{
"tag": "v0.1.10",
"kind": "patch",
"published_at": "2026-07-16T16:21:56Z"
},
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-07-16T04:31:58Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-07-15T20:42:08Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-07-15T17:42:48Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-07-15T15:13:47Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-07-15T14:08:45Z"
}
],
"recent_commits": [
{
"oid": "437b62155f885282555871ecf3f3c93cfe8aee1b",
"body": null,
"is_bot": false,
"headline": "Add update exclusion strat to README",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-20T14:56:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "661f5ef083495e273a669b19eccfaa8d846fe0e3",
"body": "Release 1.0.1 — correct fine-grained PAT permission docs",
"is_bot": false,
"headline": "Merge pull request #31 from michaelpipkin/fix-token-permission-docs",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-17T00:31:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec24142cb6a51aa84f064e1b2d7fe3bebfa2b624",
"body": "The README's Requirements and Options sections said the token needs the\n`security_events` permission. That's correct for a CLASSIC PAT, but a\nFINE-GRAINED PAT needs the \"Dependabot alerts\" repository permission (Read)\ninstead — following the old wording with a fine-grained token 403s. Fixed\nin Requi\n[…]\nomment. The\nCI-integration note already had it right.\n\nDocs only; bumps version to 1.0.1 so the corrected README publishes to npm.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Release 1.0.1 — correct fine-grained PAT permission docs",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-17T00:29:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "48a455c065042b90444ec989e41ff7ef29569fa3",
"body": "Release 1.0.0",
"is_bot": false,
"headline": "Merge pull request #30 from michaelpipkin/release-1.0.0",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-17T00:04:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "367bdd154a96d873b83180ed0bdaae5ae73319cf",
"body": "Pre-1.0 README audit against the code found one real behavior/doc mismatch\nand two minor doc drifts.\n\nBehavior fix: the \">=-shaped = agent-authored, so leave other shapes alone\"\nguard was only wired into the superseded-key removal path, not the orphan\npath — so a hand-written pin (exact/caret/scoped\n[…]\nely).\n- \"No in-range fix\" sample output updated to the current console text.\n\n157 pass, build clean. Extends the 1.0.0 release PR.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Protect hand-written pins on the orphan path + README audit fixes",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:18:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e37efdc45b311cbe180fb11537c5f3953106aecf",
"body": "First stable release. Renames the CHANGELOG [Unreleased] section to [1.0.0]\nwith a first-stable-release intro, and sets package.json version to 1.0.0.\n\nFrom here the CLI surface (flags, env vars, config schema, exit codes, and\nwhich overrides are written for a given input) is a stable contract under\nSemVer — see the README \"Versioning & stability\" section.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Release 1.0.0",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:06:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d4fd7157ec2861abcdc9bfa061abc3fad6c75ed1",
"body": "Add --exit-code CI drift gate and a cross-platform CI matrix",
"is_bot": false,
"headline": "Merge pull request #29 from michaelpipkin/add-exit-code-and-ci",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:04:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e9169f43ee23e3f160f870935c0e05d21cb59f5",
"body": "The CI matrix surfaced that Node 20 fails: pnpm@11.13.0 refuses to run on\nit (\"requires at least Node.js v22.13\"). Node 20 also reached end-of-life\nin April 2026, so a >=20 floor would claim support for an EOL runtime the\ntoolchain can't even build or test against.\n\n- package.json engines: >=20 -> >=22\n- ci.yml matrix: [20, 22, 24] -> [22, 24] (both already green on Linux+Windows)\n- README requirements + CHANGELOG updated\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Set the Node floor to >=22 for 1.0.0",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T23:00:47Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f00a880036e4a0ae2fe8c4863ffd63177facf5d2",
"body": "…rep)\n\nCompletes the 1.0.0 groundwork alongside the surface cleanup in this branch.\n\n--exit-code flag (EXIT_CODE=true, config exitCode):\n- When set, the process exits 2 if the run found any override changes; 0 when\n clean; 1 stays \"the tool failed\". Pair with --dry-run to fail CI on override\n drif\n[…]\nuses default discovery (works on Node 20+) scoped to compiled\n JS only. +3 cli.test.ts tests for the flag. 156 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add --exit-code CI drift gate and a cross-platform CI matrix (1.0.0 p…",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:54:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "406ec6b7061d6a5a11a9f8f2cc678f7f84e62b59",
"body": "Declare the CLI-only surface and align repo resolution (1.0.0 prep)",
"is_bot": false,
"headline": "Merge pull request #28 from michaelpipkin/prep-1.0-surface",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:52:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d48c243eef570349ef439a1d240bcc3634dc6240",
"body": "Groundwork for a 1.0.0 release, intended to ship with that version.\n\n- package.json: remove `main`/`types` (they pointed at the CLI entry, which\n runs on import and exports nothing) and add an `exports` restriction, so\n `import \"dependabot-agent\"` and deep imports of internal dist/ modules are\n n\n[…]\n and internal modules explicitly outside the contract.\n\nNo behavior change to the agent's decisions. 153 tests pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Declare the CLI-only surface and align repo resolution (1.0.0 prep)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:28:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "61631a1bf69d2e1e92a83861a4881177c638eb9d",
"body": null,
"is_bot": false,
"headline": "Bump version for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:19:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96f75742ebed6dbd4ed7bd9c6a844c86a0d23823",
"body": "…pm-noise\n\nReport the on-disk override shape; quiet npm ls noise; fix dangling \"via:\"",
"is_bot": false,
"headline": "Merge pull request #27 from michaelpipkin/fix-idempotent-report-and-n…",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:17:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ea6cd2663ecaf919c315395df0032e633a057c8",
"body": "Three observability fixes surfaced by the live add-path smoke test against\nthe pnpm and npm fixture repos (idempotent re-run: scoped overrides already\napplied, so no changes emitted).\n\n1. logMultiLineAdvisories chose \"split into per-line overrides\" vs the flat\n \"forcing one version\" message from T\n[…]\nds\ncleanly. Tests: +4 (effectiveOverrideSpecs; logMultiLineAdvisories scoped-\nvs-flat via captured output). 153 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Report the on-disk override shape; quiet npm ls; fix dangling \"via:\"",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T22:15:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2e16c21ba69ebb1b2f8f22caddf8c1ef399a7445",
"body": "Bump version for publish",
"is_bot": false,
"headline": "Merge pull request #26 from michaelpipkin/release-0.1.15",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:42:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b695f1423648ab7d78133893d403d6cbbdd86969",
"body": null,
"is_bot": false,
"headline": "Bump version for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:41:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5f3de71e09a0134ebc4896dcdb6fd8b4283cd9f",
"body": "Close #4: pnpm deduped-dependent skip verified safe",
"is_bot": false,
"headline": "Merge pull request #25 from michaelpipkin/close-4-deduped-verified",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:39:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "040408d7102198bddb0965742db8ad269b78d2df",
"body": "Explain why a load-bearing override is kept, not just its latest ranges",
"is_bot": false,
"headline": "Merge pull request #24 from michaelpipkin/explain-load-bearing-keep",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:39:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01ed77878912cdcf17c549c7ed36b7c3ea083be2",
"body": "Captured real `pnpm why uuid --json` from a live pnpm 10 workspace\n(PipSplit). Deduped nodes carry both name and version and no `dependents`,\nand every deduped name@version had a canonical (non-deduped) FIRST\noccurrence in the same output — which is pnpm's dedup model by definition.\nSince collectDep\n[…]\nK \"known edges\" note\n(the only remaining deferred item from the fourth review) is removed.\nDocs/comment only — no behavior change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Close #4: pnpm deduped-dependent skip verified safe against live output",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:36:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e816d42088e7d99050a61990be7261f336f4b397",
"body": "Since removal became strategy-independent (0.1.14), an orphaned override\ncan be kept because a dependent's INSTALLED range dips below the floor even\nwhen its latest range is safe. The keep-load-bearing message never caught\nup: it printed only latestRanges, so such a keep showed safe-looking latest\nv\n[…]\nning the @babel/core shape (installed below floor, latest\nsafe) surfaces the installed range as the reason. 149 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Explain why a load-bearing override is kept, not just its latest ranges",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:29:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e0848ddd3ec726d6c175996839c6b7e2056833cb",
"body": "Bump version for publish",
"is_bot": false,
"headline": "Merge pull request #23 from michaelpipkin/release-0.1.14",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:17:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ef0e6ae7e1fdfabaf29fec00d24031e638b297f",
"body": null,
"is_bot": false,
"headline": "Bump version for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:17:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "59e9d613a66fd75c82944be94a35704ad9f30418",
"body": "Cover uncovered scoped majors; preserve user pins and nested overrides",
"is_bot": false,
"headline": "Merge pull request #22 from michaelpipkin/fix-scoped-major-coverage",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1429fa43a23743c3761e5546ebc03589e93e81cb",
"body": "A fourth independent adversarial review confirmed the removal/orphan path\nis now sound (it couldn't break it) and pivoted to the scoped-WRITE path.\nThree findings, all verified and fixed; a fourth is documented for live\nverification.\n\n#1 (medium, security): computeScopedSpecs bailed to the flat over\n[…]\nd CHANGELOG under [Unreleased].\n\nTests: +3, each verified to discriminate (fails when its fix is reverted).\n148 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Cover uncovered scoped majors; preserve user pins and nested overrides",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T21:14:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a7aa51580c07a9343228ed0f75bc27629f7869f6",
"body": "…moval\n\nMake override removal strategy-independent and honor dismissed alerts",
"is_bot": false,
"headline": "Merge pull request #21 from michaelpipkin/fix-strategy-independent-re…",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:50:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c58509de7e684f6799410e0971d5c819f9474e9",
"body": "A third independent adversarial review confirmed the whole codebase\noutside the removal path is sound, and found three more issues in the\nremoval path. All three point the same way: removal must not depend on\nupdate strategy or treat an acknowledged vulnerability as gone.\n\n#1 (high, security): judge\n[…]\n-bound ranges (#2). Each fix verified\nto discriminate (its regression test fails when the fix is reverted).\n145 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Make override removal strategy-independent and honor dismissed alerts",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:47:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "77713584b3d1eb05c98766b8234d0c879de34383",
"body": "…oval\n\nNever remove a load-bearing override for a still-open alert",
"is_bot": false,
"headline": "Merge pull request #20 from michaelpipkin/fix-open-alert-override-rem…",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:07:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f0fb0d3431efd606be3b6e6fc03711ce97883b66",
"body": "An independent adversarial review of the whole codebase confirmed the\n0.1.13 removal-safety fixes hold, but surfaced a new high-severity path\nin the same catastrophic direction, plus a low report-noise issue.\n\nFinding #1 (high, security): the removal pass in computeOverrideChanges\nmatched existing o\n[…]\nrivation is disabled); the escape-refinement helper is\nunit-tested for the scoped, flat, and no-copy cases. 143 pass, build clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Never remove a load-bearing override for a still-open alert",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T20:04:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8d673e04eb64c3d9f5949a4ebf21d9ad270ceb1c",
"body": "Strip build metadata in parseSemver (review finding #5)",
"is_bot": false,
"headline": "Merge pull request #19 from michaelpipkin/fix-parse-build-metadata",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:36:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af1a2f81fe172c281582966850100de645ab4c32",
"body": "parseSemver dropped the pre-release suffix but not build metadata, so a\nversion like 1.2.3+build failed the digit-segment check and parsed as\nnull, sending callers to their conservative branch. Build metadata is\nignored for precedence per the semver spec, so it is now stripped too\n(via split(/[-+]/)\n[…]\n ordering would be a large refactor to fix only the rare\npre-release-as-installed-version case. The doc comment now explains this.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Strip build metadata in parseSemver (review finding #5)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:34:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "397f060229f7297e85a2d68493bdac6f43b5912a",
"body": "Fix four override-removal safety issues from the independent review",
"is_bot": false,
"headline": "Merge pull request #18 from michaelpipkin/fix-review-findings",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:26:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "04a6f9bd91a1286b018162d87303cfcda9463b89",
"body": "Makes this PR the 0.1.13 security release: package.json -> 0.1.13 and the\n[Unreleased] heading renamed to [0.1.13]. Merging publishes the removal-safety\nfixes to npm.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment (0.1.13)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:24:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c6aea7860f2c70ba699a0943b196228161b30bd6",
"body": "An adversarial README-vs-code review found the removal / orphan half of the agent\nunder-delivering the conservatism the README promises. Each could remove a\nstill-load-bearing override and reintroduce the CVE it held back.\n\n#1 (confirmed, live since 0.1.10): scoped keys judged against the LOWEST flo\n[…]\ngy-aware judge cases,\nsub-major fallback, all with discrimination against the pre-fix behaviour.\nShips as 0.1.13 (security patch).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix four override-removal safety issues from the independent review",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T19:16:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "00e2d2f53a1d1b23f93768528de471ae8623bbe7",
"body": "Bump to 0.1.12: correct the README to match shipped behavior",
"is_bot": false,
"headline": "Merge pull request #17 from michaelpipkin/docs-scoped-and-removal",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:32:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b028fec74ca0efeed40d4b710a7690d8c3ea38f",
"body": "README-only changes reach npm solely through a version bump, so this bundles the\ndoc fixes with the 0.1.12 bump.\n\n- \"What it does\" step 6 now notes that a multi-line advisory is fixed with one\n scoped override per release line (js-yaml@3 / js-yaml@4), not just a flat\n bounded spec -- the headline \n[…]\nones, with the conservative caveats.\n\nNo code change. package.json -> 0.1.12, CHANGELOG [0.1.12] documents why the\nrelease exists.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump to 0.1.12: correct the README to match shipped behaviour",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:31:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6fbfd3ae2d652f5c6b5f0d9a3d8122e07f339c1d",
"body": "Bump version numbers for deployment (0.1.11)",
"is_bot": false,
"headline": "Merge pull request #16 from michaelpipkin/release-0.1.11",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:22:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df2a52c83e45816169786e6139f85bd0bb2fb6e9",
"body": "Ships the workspace-internal override aging-out (#14) and the clean-exit fix for\na failed alert fetch (#12). package.json -> 0.1.11 and the [Unreleased] heading\nrenamed to [0.1.11].\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment (0.1.11)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:22:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "2a96c17bb980014e830a34056fd95652ceac79de",
"body": "Age out overrides whose only dependents are workspace-internal (#14)",
"is_bot": false,
"headline": "Merge pull request #15 from michaelpipkin/age-out-workspace-overrides",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:20:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8eaf55082085b120ef3086f8cf3cb9b052d1d3a",
"body": "Removing an override with no open alert asks \"has upstream moved on?\" by reading\nthe dependents' latest ranges from the npm registry. A workspace member has no\nregistry entry, so collectDependentRanges dropped it -- and an override reachable\nonly through workspace members was kept forever, even afte\n[…]\n, the local\nrange read, and the remove/keep verdicts -- no registry needed, since this path\nreads local manifests. 130 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Age out overrides whose only dependents are workspace-internal (#14)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:18:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9e5ef3a6ce10fa8bdfa42d788ca02f2b4f4b62f5",
"body": "Exit cleanly on a failed alert fetch instead of a libuv crash (#12)",
"is_bot": false,
"headline": "Merge pull request #13 from michaelpipkin/fix-fetch-error-crash",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T18:00:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e07a888db83a8f6158d4ecbca0ea3cb0cd6bd43a",
"body": "Fixes #12. When fetchDependabotAlerts failed (bad token, alerts disabled,\nnetwork error, any non-2xx), the agent printed the right error and then aborted\nwith `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)` and exit code 127\ninstead of 1.\n\nCause: exitWithError called process.exit(1) synchro\n[…]\ntion, no\nhang); a successful run still exits 0; --help exits 0; missing-token and\nunknown-arg still print clean errors and exit 1.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Exit cleanly on a failed alert fetch instead of a libuv crash",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:56:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3b57b290267abe159708446d24c88251ce2151ce",
"body": "Scenario test infrastructure: captured fixtures + offline replay + runbook",
"is_bot": false,
"headline": "Merge pull request #11 from michaelpipkin/scenario-test-fixtures",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:43:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77b1cae6bd316fbbad20751020c8413b99b99a94",
"body": "Prove and regression-test orphan-override removal (#2)",
"is_bot": false,
"headline": "Merge pull request #10 from michaelpipkin/prove-orphan-removal",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:43:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e637ab177c538b7281bc2a553d4daabe50e3288",
"body": "…+ runbook\n\nMakes the four scenarios the agent exists for -- add and remove an override, on\npnpm and npm -- cheap to reproduce and regression-test when future issues arrive.\n\nThe live fixtures proved the mechanisms once, but they're a poor maintenance base:\nthey wait on Dependabot scans, need a toke\n[…]\nr capture\nthe triggering payload into test/fixtures/), add a failing scenario test, fix,\nconfirm the live smoke test still passes.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add scenario test infrastructure: captured fixtures + offline replay …",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T17:39:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a84351d57fec025f77ba1439570d27b9bd357940",
"body": "The last open item on #2: the \"a parent updates upstream to a non-vulnerable\ntransitive version, so the override ages out\" loop was never exercised\nend-to-end. It's the orphan path (reconcileOrphanedOverride), which decides\nremoval from npm REGISTRY data, so a local package fixture couldn't drive it\n[…]\n verdicts, including that removal reads\nthe LATEST range (forward-looking) and never infers \"safe to remove\" from an\nabsent range.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Prove and regression-test orphan-override removal",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:32:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9e26f7826f72ceb5e0ded16d65b708b862913c5a",
"body": "Bump version numbers for deployment (0.1.10)",
"is_bot": false,
"headline": "Merge pull request #9 from michaelpipkin/release-0.1.10",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:21:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34c28325c67683194f18506d131e4ee9827e394c",
"body": "Ships scoped per-line overrides for multi-line advisories, universal across pnpm\nand npm via the version-selector mechanism (#7, #8). package.json -> 0.1.10 and\nthe [Unreleased] heading renamed to [0.1.10].\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment (0.1.10)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:18:43Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6852ca6400802b5bcec64941d0079642206111ff",
"body": "Make scoped overrides idempotent; teach the orphan path scoped keys",
"is_bot": false,
"headline": "Merge pull request #8 from michaelpipkin/fix-scoped-idempotency",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:14:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e52fcbeb1340f870b73a4281175bef0a8a01de2",
"body": "Proving the scoped feature end-to-end on a live npm workspace fixture surfaced a\nreal usability gap: npm resolves from the existing node_modules + package-lock.json\nand does NOT re-resolve when `overrides` changes. A plain `npm install` -- and\n--force, and --package-lock-only -- all leave the vulner\n[…]\n its own patched line (3.15.0, 4.3.0), and Dependabot closed all\nfour lockfile alerts -- npm scoped support proven, matching pnpm.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "npm: tell users a clean install is needed to apply new overrides",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T16:12:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a3c21451102ef62931e2a7e96537e0d064e69de9",
"body": "The scoped path was documented as pnpm-only with an npm flat-max fallback, on the\nbelief that npm overrides can't express a version selector. A probe disproves it:\nnpm honors a `js-yaml@3` override key, including for registry-transitive copies,\nand applies it on a plain `npm install`. (My earlier pr\n[…]\ne.json `overrides` block and pnpm-workspace.yaml.\n\nNo behaviour change — this makes the docs match what the code does and pins it.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Scoped overrides work on npm too — version-selector, not just pnpm",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T15:55:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "621713767fc8dd4437e626462699bd3e3bd9bcf6",
"body": "Two defects in the scoped-override path (0.1.10, unreleased), both found by running\nthe agent against the fixture a second time.\n\n1. Not idempotent — it un-wrote its own fix. computeScopedSpecs grouped by the\n INSTALLED versions to find the release lines, but once the override is applied\n the tr\n[…]\nry run against the fixture is now a clean no-op where before\nit planned to revert to the flat override and delete the scoped keys.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Make scoped overrides idempotent; teach the orphan path scoped keys",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T15:29:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a9fb021529bbb2265601cc3b0312508def6fdc28",
"body": "Scoped per-line overrides for multi-line advisories (pnpm)",
"is_bot": false,
"headline": "Merge pull request #7 from michaelpipkin/scoped-overrides-multiline",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T15:06:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0be594e3134ae203249987200b03f45fd4fb9171",
"body": "GitHub keys a member's direct-dependency alert to packages/x/package.json.\ngroupAlertsByManifestDir grouped strictly by that path, so a workspace member\nthat shares the root lockfile was treated as its own isolated package: the agent\nselected a member-local pnpm-workspace.yaml as the override source\n[…]\nly isolated package still owns its overrides. Surfaced by running the\nscoped-override feature end-to-end against the fixture repo.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fold shared-lockfile workspace members into the root override group",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T14:59:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "00d2e2d3e4204cf5c385cb79edc08b3c1dcf27ba",
"body": "Detection (0.1.9) reported when a package is vulnerable on disjoint release\nlines; this resolves it. Instead of the flat max -- which hands one version to\nevery consumer and drags the lower line across a major no advisory demands --\ncomputeOverrideChanges now writes one bounded override per line usi\n[…]\n(name@0 is too broad, since a 0.x line is a minor). Scoped npm\nsupport needs a nested-override model change and is deferred to #2.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix multi-line advisories with per-line scoped overrides (pnpm)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T14:53:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1239eea82161da87a73065395250a80c7c80a6cf",
"body": "getInstalledTree ran `pnpm list --json --depth=Infinity` without -r, so in a\nshared-lockfile pnpm workspace a dependency declared only in a packages/* member\nwas invisible at the root. findInstalledVersions returned empty, the package was\nskipped before detection ran, and no override was written -- \n[…]\nied on the multi-line fixture: -r surfaces js-yaml under both\nconsumer-old and consumer-new, where the root-only read saw neither.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "See workspace member deps: pnpm list -r",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T14:29:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a6bf60703294be212d987611c6068867f345e14b",
"body": "Bump version numbers for deployment (0.1.9)",
"is_bot": false,
"headline": "Merge pull request #6 from michaelpipkin/release-0.1.9",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:31:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17f048a93adb58ca5f44e29f86aea14113b08ee1",
"body": "Ships the multi-line advisory detection merged in PR 5. Releasing it now rather\nthan holding it for the scoped-override work, because the two repos that consume\nthis agent take it from npm -- pip-cost-sharing on a Monday 06:00 cron -- so an\nunreleased detector detects nothing. Its whole purpose is t\n[…]\nuntil the next one arrives. An informational-only change that cannot alter an\noverride is the right thing to ship into that quiet.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump version numbers for deployment",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:30:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5e5a0362227fed8062159988966f7123ba57658e",
"body": "Report multi-line advisories instead of firing silently (#4)",
"is_bot": false,
"headline": "Merge pull request #5 from michaelpipkin/detect-multiline-advisories",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:22:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d6417f256c23fa61c875f2409bf7b4a3b0fdb75",
"body": "An advisory carries one vulnerable range per release line, each with its own\nfirst_patched_version, so a package vulnerable on two lines at once has no single\npatched version. mergeAlert takes the max -- deliberately, per #3: it is the only\nchoice that can't leave a vulnerable copy quietly resolvabl\n[…]\nal tar case -- seven nested advisories on one line,\nwhere the max IS the minimum and reporting anything would be a false positive.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Report multi-line advisories instead of firing silently (#4)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-16T04:19:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1c50979e417eecc5ed423ee714b46877568a1e75",
"body": "Settle the multi-line advisory question in favor of max (#2)",
"is_bot": false,
"headline": "Merge pull request #3 from michaelpipkin/settle-multiline-advisory-max",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T20:41:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd67834294e1edcdb0e0faecf341bb416a4d74b9",
"body": "Issue #2 flagged that mergeAlert keeps the highest first_patched_version across\na package's alerts, which can force a tree onto a newer major than any advisory\nrequires: an advisory carries one vulnerable range per release line, each with\nits own patch, so GHSA-mh29-5h37-fv8m patches js-yaml's \"< 3.\n[…]\n-- the only mechanism that can hand\ndifferent consumers different versions, and still a feature with a design rather\nthan a patch.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Settle the multi-line advisory question in favor of max (#2)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T20:36:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b72f53e6bd0826f39322637cd2083523a80977fb",
"body": "README:413 and mergeAlert's comment both stated \"highest first_patched_version\nwins\" as settled intent, with no hint that a package can have more than one\npatched version. An advisory carries one vulnerable range per release line, each\nwith its own patch -- GHSA-mh29-5h37-fv8m has \"< 3.14.2 -> 3.14.\n[…]\n the current\nbehaviour wrong).\n\nBoth sites now point there, so the claim stops reading as considered when it is\nmerely unexamined.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Flag the multi-line advisory assumption at both sites (#2)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T18:50:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "92c254fb50c45afca6b59ea13d94170e9fa6e06f",
"body": null,
"is_bot": false,
"headline": "Bump version numbers for deployment",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T17:42:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fd48ca1a1dab030f213e8f5e57db79d38c6ee38",
"body": "A full run against a live tree disproved two claims this tool was making.\n\nThe guidance called escapes with an upstream fix \"stale dependents\" and said\nthat \"moving off the installed version clears the escape\". For vite it does\nnot: @angular/build@22.0.6 -- itself the latest release -- declares\n`vit\n[…]\ning only, no logic change -- but output that promises a fix the user cannot\napply is worse than output that admits the constraint.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Say an upstream fix exists, not that you can reach it",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T17:31:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "816f1b6b491d0449bcb844d599fa180599190dad",
"body": "Git Bash can export PNPM_HOME as /c/Users/you/AppData/Local/pnpm. It converts\nthat to Windows form when IT launches a native binary, so a hand-typed\n`pnpm update` works -- which is what made this confusing to diagnose. A pnpm\nspawned by this agent inherits the raw POSIX value, derives its store as\n\\\n[…]\n at the next \"## [\", so the\nsecond section's entries would have been dropped from the release notes\nwithout ever failing anything.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Repair POSIX PNPM_HOME on Windows before shelling out",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T17:21:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ebe943ffc9cb87488f0bc0a4e7a5d61510bb2926",
"body": "Every path rendered as the queried package's own name -- \"tar - via: tar\",\n\"uuid - via: uuid\" -- which told the reader nothing. walkDependents seeded\npathLabel with entry.name (the package being queried), so the\n`pathLabel || `${dep.name}@${dep.version}`` fallback was dead code: pathLabel\nwas truthy\n[…]\n's scope says.\n\nThe npm implementation labels from edge.name, which is already the root's\ndirect dependency, and needed no change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Label deployment-impact paths with the real dependency (pnpm)",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T16:59:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c9a0e8222a8b89aa66188003fbe7ad47a33252b",
"body": "Both bugs surfaced on the first run against real alerts.\n\nfindInstalledVersion returned the first hit of a tree walk, documenting the\nassumption that \"all instances should be the same version after the package\nmanager resolves with any existing overrides applied.\" That is backwards: it\nholds after a\n[…]\nerified against the live tree: escapes 2 -> 4 (tar and esbuild now caught),\nand scope now matches Dependabot on all five packages.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Check every installed copy; take scope from Dependabot",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T16:49:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "410c728ed4902b692aa4e2024be7149fe774abf9",
"body": "Three changes to the no-in-range-fix report, all driven by what it actually\nprinted against a real tree.\n\nJudge by the resolved version, not the spec floor. An unbounded override can\nsit far above its own floor: pip-cost-sharing's uuid override reads\n\">=11.1.1\" but had resolved to 14.0.1, and js-yam\n[…]\nscapes caused purely by\na stale dependent show up but would not survive a real run. Say so rather\nthan let the list read as final.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Judge escapes by the resolved version; split them by actionability",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T15:38:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b3f50013d01fe1767e32edd55b7dff7783781049",
"body": "collectDependentRanges found each dependent from the tree -- where pnpm why\nand npm explain both report its installed version -- collected the names\ninto a Set, dropped the versions, and then read the declared range from the\ndependent's `latest` manifest. Latest can declare something entirely\ndiffer\n[…]\nme package can appear at\nseveral versions declaring different ranges. Internal interface only -- no\nCLI or config surface changes.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Resolve dependent ranges at the installed version, not latest",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:53:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e525ed0cc708ae7ad8d918bf909f59cfb7f02bca",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add changelog entry for orphan-path escape detection",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:38:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "eeedf26a62654e9001330d0bb710eb831e8f4371",
"body": "0.1.5 wired the escape check into computeOverrideChanges only, which\nhandles overrides driven by an open alert. Overrides with no open alert go\nthrough reconcileOrphanedOverride instead, which asked only \"is this still\nload-bearing?\" and reported every kept override identically. A repo with\nzero ope\n[…]\n work in one\nplace, and findEscapingRanges/overrideFloor as pure functions so the six real\noverrides above serve as test fixtures.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Detect no-in-range-fix on the orphan path too",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:38:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ca86cbf631ef4162ea8a8f872fecbe9e3767b90",
"body": "An override that forces a package outside its dependents' compatible\nrange installs cleanly and closes its Dependabot alert, so nothing in the\npipeline surfaced it. These are now reported separately from routine\nchanges, with a marker, a warning block, and a summary count.\n\nThe boundary follows npm'\n[…]\nckage.\n\nCorrect two README claims that overrides \"never\" force a breaking major\nbump. They can and do when no in-range fix exists.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Flag overrides with no in-range fix; fix 0.x compatibility bounds",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-15T14:04:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c768860e7d14344066065dde200e68753b834639",
"body": null,
"is_bot": false,
"headline": "Update package.json",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-12T18:37:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de0181146d17c7a0e185de11f786445e980b744a",
"body": null,
"is_bot": false,
"headline": "Update package version for deployment",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-12T18:30:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea1911f2fe2d01375153dfd2a11415471e06b9d5",
"body": null,
"is_bot": false,
"headline": "Add license and update README",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-12T18:30:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0deefc9f11d9dce6f75b995fb566cf603a8028d3",
"body": "actions/checkout@v7, actions/setup-node@v6, pnpm/action-setup@v6 —\nclears the Node 20 runtime deprecation warning. [no-deploy]\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Bump workflow actions to Node 24 majors",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T02:04:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a0299f679e1e8fdc067b794c7afd09121366cc3c",
"body": "This is a pnpm project (pnpm-lock.yaml is the tracked lockfile), so\nmaintain a single lockfile. Install/build with pnpm; keep `npm publish`\nfor OIDC Trusted Publishing (publish needs no lockfile). Pin the pnpm\nversion via the packageManager field. [no-deploy]\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Switch CI to pnpm; drop package-lock.json",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T02:01:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0d8433bf9979324ea204ee9e73c51a48803f5e9b",
"body": "The publish workflow uses `npm ci`, which requires a committed\nlockfile. Generate one from package.json to fix the failing\n\"Install dependencies\" step. [no-deploy]\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add package-lock.json so CI npm ci can install",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T01:56:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b150ff253c81ea7e4d11cfd433b27114fc4b3e79",
"body": null,
"is_bot": false,
"headline": "Add pusblish workflow",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T01:36:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e370a50ae146dca80142cdb25dce6b33af992ada",
"body": null,
"is_bot": false,
"headline": "Update README",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-07-09T00:14:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7fe8aef7606944b8a3f923c6d84fcb50371f5b13",
"body": null,
"is_bot": false,
"headline": "Fix version bounding bug",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-24T00:42:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc9a62aa3c9757ddea128657a954c382186cfaa0",
"body": null,
"is_bot": false,
"headline": "Update documentation",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-23T22:31:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ddd040845a9a444e7cc0111592e3ef6ed817d6e6",
"body": "Npm",
"is_bot": false,
"headline": "Merge pull request #1 from michaelpipkin/npm",
"author_name": "Michael Pipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T18:36:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "056f8d57b449f017c60f13044e9d1ab98592a48c",
"body": null,
"is_bot": false,
"headline": "Set version and author to prep for publish",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T03:37:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d8abb4fb7b1142d9c49b161a58f81924244a89c",
"body": null,
"is_bot": false,
"headline": "Update to find all package manifests",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T03:21:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "533519ddb50299cf53e1f8d73c53b61cb9e1a4ea",
"body": null,
"is_bot": false,
"headline": "Refactor to generic CLI tool",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T02:47:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "47a976d51c30f220dfeeac9e8c8fd6d955752cb2",
"body": null,
"is_bot": false,
"headline": "Initial project setup",
"author_name": "michaelpipkin",
"author_login": "michaelpipkin",
"committed_at": "2026-06-22T01:45:54Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 15,
"commits_last_year": 87,
"latest_release_at": "2026-07-20T14:57:09Z",
"latest_release_tag": "v1.0.2",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 4,
"days_since_latest_release": 6,
"mean_days_between_releases": 0.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": false,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "dependabot-agent",
"exists": true,
"license": "MIT",
"keywords": [
"dependabot",
"overrides",
"npm",
"pnpm",
"security",
"vulnerabilities",
"cli"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/dependabot-agent",
"is_deprecated": false,
"latest_version": "1.0.2",
"repository_url": "https://github.com/michaelpipkin/dependabot-agent",
"versions_count": 20,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 2659,
"first_published_at": "2026-06-22T03:40:16.937000Z",
"latest_published_at": "2026-07-20T14:57:05.915000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 59036,
"source_files_sampled": 25,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 2,
"malicious_count": 0,
"assessed_package": "npm:dependabot-agent@1.0.2",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "js-yaml",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.1.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 27,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 4,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "michaelpipkin",
"commits": 87,
"avatar_url": "https://avatars.githubusercontent.com/u/5658291?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 2,
"reason": "3 out of 13 merged PRs checked by a CI test -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/15 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "437b62155f885282555871ecf3f3c93cfe8aee1b",
"ran_at": "2026-07-27T01:33:33Z",
"aggregate_score": 3.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-20T14:57:13Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-17T00:31:15Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/michaelpipkin/dependabot-agent",
"host": "github.com",
"name": "dependabot-agent",
"owner": "michaelpipkin"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"security": 49,
"vitality": 74,
"community": 32,
"governance": 55,
"engineering": 47
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"commits_last_year": 87,
"human_commit_share": 1,
"days_since_last_push": 6,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "87 commits in the last year",
"points": 17.5,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 87
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 15,
"latest_release_tag": "v1.0.2",
"releases_from_tags": false,
"days_since_latest_release": 6,
"mean_days_between_releases": 0.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "15 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 15
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 32,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 57,
"inputs": {
"packages": [
"dependabot-agent"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 2659
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,659 downloads/month across npm",
"points": 45.7,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2659,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"merged_prs": 27,
"open_issues": 0,
"closed_issues": 4,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "27/27 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 27,
"decided": 27
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/15 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 41,
"inputs": {
"followers": 2,
"owner_type": "User",
"is_verified": null,
"owner_login": "michaelpipkin",
"public_repos": 10,
"account_age_days": 4672
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2 followers of michaelpipkin",
"points": 3.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2,
"login": "michaelpipkin"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~12 yr old",
"points": 19.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 12
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"dependabot-agent"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 6
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 6 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 6
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "20 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 20
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 47,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "3 out of 13 merged PRs checked by a CI test -- score normalized to 2",
"points": 4,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "at_risk",
"name": "Documentation",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 49,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 36,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 3.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "3 out of 13 merged PRs checked by a CI test -- score normalized to 2",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/15 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:dependabot-agent@1.0.2 runtime dependency closure — what installing the published package pulls in — 2 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:dependabot-agent@1.0.2",
"assessed": 2
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 2,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 2,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.805,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "70 of 87 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 70,
"sampled": 87
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.506,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "44 of the last 87 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 44,
"sampled": 87
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 59036,
"source_files_sampled": 25,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/25 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 25,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-27T01:33:47.962573Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/m/michaelpipkin/dependabot-agent.svg",
"full_name": "michaelpipkin/dependabot-agent",
"license_state": "standard",
"license_spdx": "MIT"
}