$ the-wire · showcase
Scanner triage comments now name the person who owes a fix
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
oss-scanner's triage comment now addresses the pull request opener by name when their SECURITY.md and project.yaml disagree with its own configuration, and AutoGPT dropped its advisory threshold to every severity.
Tag the pull request opener in the triage comment when their setup needs attention anthropics/oss-scanner
The comment now asks the pull request opener directly when SECURITY.md lists a different email than primary_contact, when GitHub security advisories are enabled and oss-scanner must be added as a trusted reporter, or when SECURITY.md mentions advisories that project.yaml does not configure. Those mismatches used to sit in the comment unaddressed to anyone in particular; they now arrive as a req...
projects/autogpt: send reports of every severity to GitHub anthropics/oss-scanner
AutoGPT's maintainers want every report filed as a GitHub private vulnerability report, so the project lowered github_security_advisory's minimum from high to low. Email keeps its default of low, so every report still arrives by email as well; the change only widens what reaches GitHub, not what reaches maintainers' inboxes.
Merge pull request #1253 from crenshaw-dev/patch-1 anthropics/oss-scanner
argo-cd gained output format configuration for security advisories, merged from a contributor patch.
add scilab anthropics/oss-scanner
Scilab and Thunderbolt filed enrolment requests for projects/scilab and projects/thunderbolt, each asserting core maintainership and a local pass of tools/validate.py.
