v0.28.0

SCA is now graded on what the scanner can see. A uv.lock package from git or a direct URL makes an enforcing SCA control partial, because no dependency scanner can look such a package up.

Changed

• SCA and uv.lock (#497, by @OfirOhan, thank you). A dependency scanner looks packages up by name and version. A package that uv.lock (at the repository root) installs from a git repository or a direct url is invisible to every scanner. An enforcing SCA control in such a repository is now partial, and the reason names the packages:

  SCA is partial (.github/workflows/ci.yml): uv.lock installs en-core-web-sm from a git or URL source, which no dependency scanner can look up
  

  What doesn't count:

  • packages from a registry other than PyPI, since a mirror or proxy serves PyPI's packages under the same names;
  • path, directory and editable sources, which are the repository's own code.

  --repo and the browser scan fetch the root uv.lock for this, and nothing deeper in the tree.

• SARIF: a partial verdict's message no longer adds "so a failing run does not block a pull request" to every reason. That's only true when the reason is a check that isn't required to merge (#497).

Grades

Compared with 0.27.0 across 179 repositories: every repository in the release corpus with a root uv.lock (15 of the 276), plus 164 that code search found installing a package from git or a URL in theirs. The change cannot touch a repository without a root uv.lock.

• 1 changed: its uv.lock installs a package from a git repository, so its enforcing SCA grade moved to partial.
• 2 unchanged: they also grade SCA enforcing, but their lockfiles have no git or URL sources.
• 23 unchanged: their SCA was already advisory, which this change leaves alone.

No other grade changed.

Full changelog: 0.27.0...0.28.0