Skip to content

v1.2.0: Fewer false alarms on upgrades, security policy and OpenSSF Scorecard

Marketplace
Marketplace

Choose a tag to compare

View all tags
@salemalem salemalem released this 05 Oct 06:27
· 30 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.2.0
9345a37
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@v1 points to this release, so existing workflows get it automatically. No changes needed.

Fixes

  • Ordinary upgrades are no longer flagged as source changes. Every version bump in a lockfile was reported as a "source / integrity" change, which blocked routine Dependabot and Renovate PRs. Now this check only fires when the same version points to a different tarball or hash, or an upgrade suddenly downloads from a different server. This was fixed on the npmscan.com side and already applies to every version of the action.
  • Advisory summaries in the PR comment can no longer turn into stray formatting or links.
  • When a package has more than 5 advisories, the comment now says "…and N more" instead of looking complete.

Trust and transparency

  • Security policy with private vulnerability reporting and response times: see SECURITY.md.
  • OpenSSF Scorecard runs weekly. Every action this repo uses is pinned to a commit SHA.
  • MIT license, contributing guide, and issue forms, including one for reporting false positives and false negatives.
  • The README now explains exactly what leaves your runner and how to pin the action to a commit SHA.

Tested on

npm, pnpm, Yarn classic and Yarn Berry lockfiles, plus monorepos, new lockfiles, fork PRs and API outages. Every PR to this repo also runs the action against the live npmscan.com API.

📖 Full docs: https://npmscan.com/docs/github-action

Assets 3
Loading