$ the-wire · showcase
OSS Scanner routes advisories by severity, formal-math lands a 3-SAT ETH formalization
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
oss-scanner added a per-project output_format that decides which severities reach email and which reach GitHub private vulnerability reporting, while formal-math merged a Lean 4 project formalizing a paper claiming a 2^o(n) 3-SAT algorithm and the falsity of the Exponential Time Hypothesis.
Let projects choose where reports go by severity anthropics/oss-scanner
A new optional output_format field sets the lowest severity sent to email (default low) and to GitHub private vulnerability reporting (default high), so a project can now keep low-severity findings out of the advisory queue or push them there deliberately. Pick your thresholds before the defaults decide for you: email low, GitHub high.
Add eth: paper and Lean 4 formalization of "A 2^o(n) Time Algorithm for 3-SAT" anthropics/formal-math
The eth/ Lake project (Lean v4.33.1, Mathlib v4.33.1) states two propositions on Mathlib's Turing machines, that the Exponential Time Hypothesis is false and that one deterministic machine counts, for every k, the satisfying assignments of k-CNF formulas within the paper's time bound, with Solution.lean proving both from the files under proof/ and comparator.json naming them for Comparator.
State that pgp only applies to email reports anthropics/oss-scanner
The docs now say PGP applies to email reports only, since GitHub private vulnerability reporting does not use a project's key, and drop the promise that every report is encrypted. If you relied on that blanket guarantee in a disclosure policy, the guarantee was never true for the GitHub channel.
Send gopacket reports through GitHub only anthropics/oss-scanner
gopacket reports now go only through private GitHub Security Advisories, at low severity and above, making the advisory the sole delivery channel for a project that previously also had email.
Merge pull request #1157 from p-linnane/homebrew-private-vulnerability-reports-high anthropics/oss-scanner
Homebrew now has high-severity private vulnerability reports enabled, narrowing what reaches the project by email relative to its earlier configuration; the wasmtime thread covers the same shift, with github security advisories favored over emails. The knowledge-work-plugins bump of claude-for-financial-advisors (96fbcb47 to ab454f4c) is routine.
