All pull requests

Pull requests

• feat(cli): add --allow-private-registry flag to permit internal registries

  #1575·Nachiket-Roy opened Nov 9, 2026Contributor·

  ·
  3

• fix(security): validate repo-configured registry URLs against private networks (SSRF)

  #1574·Nachiket-Roy opened Nov 9, 2026Contributor·

  ·
  6

• fix(security): sanitize package names and summaries in stdout against workflow command injection

  #1573·Nachiket-Roy opened Nov 9, 2026Contributor·

  ·
  1

  6

• fix: wrap package names in backticks in PR summaries to prevent mentions

  #1572·Nachiket-Roy opened Nov 9, 2026Contributor·

  ·
  1

  4

• fix(security): disable SQLite trusted_schema for local advisory databases

  #1568·Nachiket-Roy opened Nov 9, 2026Contributor·

  ·
  1

  5

• test: clear the remaining scattered test type errors (part of #1491)

  #1566·prx-my opened Nov 9, 2026Contributor·

  ·
  13

• test: complete the override context fixtures (part of #1491)

  #1565·prx-my opened Nov 9, 2026Contributor·

  ·
  2

• test: type the CLI, JSON-output and usage fixtures (part of #1491)

  #1564·prx-my opened Nov 9, 2026Contributor·

  ·
  4

• fix(overrides): list each OA010 vulnerable version once

  #1563·draarivpatel-ui opened Nov 9, 2026·

  ·
  1

  3

• fix(overrides): list each vulnerable version once in the OA010 message

  #1562·costajohnt opened Nov 8, 2026·

  ·
  1

  1

• fix(overrides): de-duplicate versions in OA010 finding message

  #1561·HarshRajSinghania opened Nov 8, 2026·

  ·
  1

  7

• fix(gate): show a notice when --fail-on runs with unresolved advisories

  #1558·Nachiket-Roy opened Nov 8, 2026Contributor·

  ·
  40

• docs: complete the Docusaurus (pnpm monorepo) case study (#912)

  #1556·muntasir-396 opened Nov 8, 2026Contributor·

  ·
  12

• feat(sbom): attach advisory database metadata and offline status to CycloneDX and SPDX outputs

  #1555·Nachiket-Roy opened Nov 7, 2026Contributor·

  ·
  1

  25

• fix(overrides): respect semver breaking boundaries in OA010 caret rewrite

  #1553·muntasir-396 opened Nov 7, 2026Contributor·

  ·
  1

  7

• fix: preserve caret ceilings when raising override floors

  #1552·vianmangal opened Nov 7, 2026Contributor·

  ·
  1

  7

• fix(overrides): ignore upper-bound parent ranges when checking OA009 floor

  #1551·muntasir-396 opened Nov 7, 2026Contributor·

  ·
  1

  9

• fix: print a runnable within-range refresh command on yarn berry

  #1547·RClaudiuM opened Nov 6, 2026·

  ·
  46

• feat(parsers): scan pinned requirements.txt behind --python flag (#672)

  #1546·bhushan4work opened Nov 6, 2026Contributor·

  ·
  51

• fix(overrides): check npm: alias floors in OA008

  #1544·muntasir-396 opened Nov 6, 2026Contributor·

  ·
  1

  8

• fix(yarn): respect negated workspace patterns on Yarn Berry (#1538)

  #1541·coder-Yash886 opened Nov 6, 2026Contributor·

  ·
  1

  36

• fix(remediation): emit yarn up instead of yarn upgrade for yarn berry (#1537)

  #1539·bhushan4work opened Nov 6, 2026Contributor·7 tasks done·

  ·
  1

  57

• fix(yarn): resolve workspace globs and scope direct fixes

  #1532·vianmangal opened Nov 5, 2026Contributor·

  ·
  1

  13

• fix(cli): reject ambiguous report ordering

  #1525·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  6

• fix(cli): reject empty --report= value

  #1524·vianmangal opened Nov 4, 2026Contributor·

  ·
  1

  3