Issues

• Dependency scan report (2026-11-01)

  dependencies
  future-architect/uzomuzo-oss#612 · Filter by author github-actions opened on Nov 1, 2026

• cargo dependency graph includes dev and optional dependencies, inflating counts and transitive advisories

  future-architect/uzomuzo-oss#608 · Filter by author kotakanbe opened on Oct 30, 2026

• stable_version picks a prerelease (e.g. 4.2.0-RC1) when deps.dev's default version is a prerelease and GA releases exist

  future-architect/uzomuzo-oss#596 · Filter by author kotakanbe opened on Oct 28, 2026

• Advisories scored only with CVSS v4 are treated as unknown severity

  future-architect/uzomuzo-oss#594 · Filter by author kotakanbe opened on Oct 27, 2026

• Withdrawn advisories that deps.dev still lists are counted as unknown-severity advisories

  future-architect/uzomuzo-oss#593 · Filter by author kotakanbe opened on Oct 27, 2026

• cargo: RustSec unmaintained notices are counted as vulnerabilities of unknown severity

  future-architect/uzomuzo-oss#592 · Filter by author kotakanbe opened on Oct 27, 2026

• Setting GITHUB_TOKEN turns replace into review when the GitHub repository no longer exists (npm faker, bcrypt-nodejs)

  future-architect/uzomuzo-oss#588 · Filter by author kotakanbe opened on Oct 26, 2026

• maintainer-domain: recorded npm e-mails can be stale, and trusted-publishing packages are not covered (GitHub-side domains)

  future-architect/uzomuzo-oss#576 · Filter by author kotakanbe opened on Oct 21, 2026

• diet: STATUS shows "Archived" instead of the scan classification for archived dependencies

  future-architect/uzomuzo-oss#575 · Filter by author kotakanbe opened on Oct 20, 2026

• Support maintainer-domain checks for versionless npm PURLs

  bug
  future-architect/uzomuzo-oss#572 · Filter by author kotakanbe opened on Oct 20, 2026

• scan: decide the default evaluation scope (direct only vs. transitive) by measuring cost and extra findings

  future-architect/uzomuzo-oss#564 · Filter by author kotakanbe opened on Oct 18, 2026

• scan: report how many transitive dependencies were skipped (and via which direct deps)

  future-architect/uzomuzo-oss#562 · Filter by author kotakanbe opened on Oct 18, 2026

• feat(actions): read actions.lock as an input for --include-actions (deferred)

  enhancement
  future-architect/uzomuzo-oss#559 · Filter by author kotakanbe opened on Oct 15, 2026

• fix(actions): treat $/… same-repo references as local actions

  bug
  future-architect/uzomuzo-oss#558 · Filter by author kotakanbe opened on Oct 15, 2026

• Guess a GitHub URL's package from the repository's declared manifest name, not the repo name

  enhancement
  future-architect/uzomuzo-oss#556 · Filter by author kotakanbe opened on Oct 15, 2026

• Versionless deps.dev purl lookup drops package identity, leaving RepoURL empty

  bug
  future-architect/uzomuzo-oss#555 · Filter by author kotakanbe opened on Oct 15, 2026

• diet: call_site_count and api_breadth are name-based lower bounds (methods on returned objects, base classes, shadowing)

  enhancement
  future-architect/uzomuzo-oss#552 · Filter by author kotakanbe opened on Oct 15, 2026

• diet (Go): calls are missed when the package name differs from the import path (v4, v1, jsoniter, lru)

  buglang:go
  future-architect/uzomuzo-oss#551 · Filter by author kotakanbe opened on Oct 15, 2026

• diet: dynamic import, inline require and mixed dot imports are rated trivial however much they are used

  buglang:golang:javascript
  future-architect/uzomuzo-oss#550 · Filter by author kotakanbe opened on Oct 15, 2026

• diet (JS/TS): .cjs/.mts/.cts, Vue/Svelte, import = require, template-literal require are not seen; @types/* counted as easy wins

  buglang:javascriptlang:typescript
  future-architect/uzomuzo-oss#549 · Filter by author kotakanbe opened on Oct 15, 2026

• diet (Python): wheel import-name lookup fails for large wheels and namespace packages

  buglang:python
  future-architect/uzomuzo-oss#548 · Filter by author kotakanbe opened on Oct 15, 2026

• diet (Java): Maven coordinates that do not match the Java package are reported unused; sibling artifacts get each other's use

  buglang:java
  future-architect/uzomuzo-oss#547 · Filter by author kotakanbe opened on Oct 15, 2026

• Add --fail-on-verdict to gate CI on the scan verdict (separate from --fail-on)

  enhancement
  future-architect/uzomuzo-oss#541 · Filter by author kotakanbe opened on Oct 14, 2026

• Dependency scan report (2026-10-01)

  dependencies
  future-architect/uzomuzo-oss#523 · Filter by author github-actions opened on Oct 1, 2026

• Verdict says replace for archived packages that ADR-0020 labels Stalled

  future-architect/uzomuzo-oss#507 · Filter by author kotakanbe opened on Sep 2, 2026