All pull requests

Pull requests

• Let a re-run release job replace the SBOM it pinned last time

  #500·vpetersson-bot opened Oct 28, 2026Contributor·

  ·
  1

• build(deps): bump the uv group, and pin the Dockerfile uv image to 0.13.5

  #499·vpetersson-bot opened Oct 28, 2026Contributor·

  ·
  1

• Drop the JavaScript Dependencies component from the SBOM workflow

  #498·vpetersson-bot opened Oct 28, 2026Contributor·

  ·
  1

• build(deps): bump the github-actions group across 1 directory with 4 updates

  dependenciesgithub_actions
  #497·dependabot[bot] opened Oct 27, 2026Bot·

  ·

• build(deps): bump the uv group with 4 updates

  dependenciespython:uv
  #496·dependabot[bot] opened Oct 27, 2026Bot·

  ·

• Stop cdxgen running the scanned project's install, and resolve composer.json safely

  #491·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  6

• Look up inputs only inside WORKING_DIR, not at the repository root

  #490·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  4

• Stop sending credentials to unsafe upload endpoints, and add Dependency-Track OIDC

  #489·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  6

• Report drift against the previous SBOM, and fail when it collapses

  #487·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  15

• Let users sign their SBOMs: identifiers first, then the recipe

  #486·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  13

• Fix two stale config claims: the GitLab lock file and tools_release

  #485·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  2

• Sign and attest the Docker image

  #483·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  9

• Harden the GitHub workflows: permissions, timeouts, zizmor

  #482·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  10

• Add copy-paste workflow examples and a monorepo guide

  #481·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  1

  11

• Refuse bad input in Step 1 instead of reporting success

  #480·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  1

  11

• Meet CISA 2026 and BSI fields: generation context, tool, supplier, no vulnerabilities

  #479·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  12

• Contributor hygiene: hooks from uv.lock, macOS-green tests, uv pinned by the lock

  #478·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  2

• Stop PURL clean-up deleting real identifiers, run it with ENRICH off, version the cache

  #477·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  11

• Show each run's result on GitHub: summary, outputs, link, annotations

  #476·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  11

• Make the first run work when copied from the README

  #475·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  2

• Pin each release's Docker image by digest

  #474·aurangzaib048 opened Oct 25, 2026Contributor·

  ·
  13

• Make error telemetry safe to send, and say that it is sent

  #473·aurangzaib048 opened Oct 25, 2026Contributor·

  ·
  16

• Release from the commit being released, and refuse a mismatched tag

  #472·aurangzaib048 opened Oct 25, 2026Contributor·

  ·
  16

• Keep every package no registry publishes off the network

  #458·aurangzaib048 opened Oct 21, 2026Contributor·

  ·
  23

• Check SPDX against its schema before uploading it

  #452·aurangzaib048 opened Oct 15, 2026Contributor·

  ·
  1

  22