Search results

Maven: <exclusions> on a direct dependency are silently dropped, producing false positives

Status: Open.

#17 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 29, 2026

Maven multi-module scans merge every POM into one resolve pass, and nothing in the output says so

Status: Open.

#16 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 29, 2026

Unversioned OSV second pass for MAL- advisories on yanked packages

enhancementNew feature or requestNew feature or request

Status: Open.

Feature

#13 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 28, 2026

Report declared licences, and emit CycloneDX licenses

enhancementNew feature or requestNew feature or request

Status: Open.

Feature

#12 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 28, 2026

Triage/ignore file, with --fail-on <severity> alongside it

enhancementNew feature or requestNew feature or request

Status: Open.

Feature

#11 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 28, 2026

Publish 0.1.0 — the documented install commands do not work yet

Status: Open.

Task

#10 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 28, 2026

Malicious packages are indistinguishable from ordinary CVEs in the table renderer

bugSomething isn't workingSomething isn't working

good first issueGood for newcomersGood for newcomers

Status: Open.

Bug

#9 In IcebergAI/IcebergSCA;

· richardmhope opened on Jul 28, 2026