All pull requests

Pull requests

• build(deps): bump the github-actions group with 4 updates

  dependenciesgithub_actions
  #497·dependabot[bot] opened Oct 27, 2026Bot·

  ·

• build(deps): bump the uv group with 4 updates

  dependenciespython:uv
  #496·dependabot[bot] opened Oct 27, 2026Bot·

  ·

• Add RELEASE_INCLUDES: a product release includes other products' releases

  #494·vpetersson-bot opened Oct 26, 2026Contributor·

  ·
  2

• Pin sbom-tools; fetch tools-rolling only from master builds

  #493·vpetersson-bot opened Oct 26, 2026Contributor·

  ·
  8

• Stop cdxgen running the scanned project's install, and resolve composer.json safely

  #491·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  6

• Look up inputs only inside WORKING_DIR, not at the repository root

  #490·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  4

• Stop sending credentials to unsafe upload endpoints, and add Dependency-Track OIDC

  #489·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  6

• Report drift against the previous SBOM, and fail when it collapses

  #487·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  15

• Let users sign their SBOMs: identifiers first, then the recipe

  #486·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  13

• Fix two stale config claims: the GitLab lock file and tools_release

  #485·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  2

• Sign and attest the Docker image

  #483·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  9

• Harden the GitHub workflows: permissions, timeouts, zizmor

  #482·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  10

• Add copy-paste workflow examples and a monorepo guide

  #481·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  1

  11

• Refuse bad input in Step 1 instead of reporting success

  #480·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  1

  11

• Meet CISA 2026 and BSI fields: generation context, tool, supplier, no vulnerabilities

  #479·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  12

• Contributor hygiene: hooks from uv.lock, macOS-green tests, uv pinned by the lock

  #478·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  2

• Stop PURL clean-up deleting real identifiers, run it with ENRICH off, version the cache

  #477·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  11

• Show each run's result on GitHub: summary, outputs, link, annotations

  #476·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  11

• Make the first run work when copied from the README

  #475·aurangzaib048 opened Oct 26, 2026Contributor·

  ·
  2

• Pin each release's Docker image by digest

  #474·aurangzaib048 opened Oct 25, 2026Contributor·

  ·
  13

• Make error telemetry safe to send, and say that it is sent

  #473·aurangzaib048 opened Oct 25, 2026Contributor·

  ·
  16

• Release from the commit being released, and refuse a mismatched tag

  #472·aurangzaib048 opened Oct 25, 2026Contributor·

  ·
  16

• Keep every package no registry publishes off the network

  #458·aurangzaib048 opened Oct 21, 2026Contributor·

  ·
  23

• Check SPDX against its schema before uploading it

  #452·aurangzaib048 opened Oct 15, 2026Contributor·

  ·
  1

  22

• Report each failure to Sentry once, and respect the classification

  #448·vpetersson-bot opened Oct 9, 2026Contributor·

  ·
  3