Version updated for https://github.com/jfrog/boost to version v0.9.0. This publisher is shown as ‘verified’ by GitHub. This action is used across all versions by 2 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed What’s Changed Release v0.7.23 by @yahav-ohana in https://github.com/jfrog/boost/pull/41 Release v0.7.25 by @menachemm-byte in https://github.com/jfrog/boost/pull/44 docs(readme): simplify mascot, focus on token savings, add report commands by @yahav-ohana in https://github.com/jfrog/boost/pull/47 docs(readme): update release badge to v0.8.6 and stars to 258 by @yahav-ohana in https://github.com/jfrog/boost/pull/48 New Contributors @menachemm-byte made their first contribution in https://github.com/jfrog/boost/pull/44 Full Changelog: https://github.com/jfrog/boost/compare/v0.7.23...v0.9.0

Version updated for https://github.com/kucherenko/jscpd to version v5.0.12. This action is used across all versions by 4,427 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Highlights Bug Fixes Rename cpd binary and npm packages to jscpd — the CLI binary was named cpd (cpd.exe on Windows), which collided with an executable name flagged by some antivirus software (McAfee, Trend Micro), causing false-positive blocking. The binary and platform npm packages are now named jscpd / jscpd-*. Closes #826 (#854) Recognize ; line comments for Lisp/Clojure/Scheme/Racket — these languages fell through to C-style comment handling, so ; comments were tokenized as code and --mode weak / --skip-comments couldn’t drop them. Closes #849 (#850, thanks @laurynas-biveinis) Use HTTPS for SARIF schema URI — avoids “untrusted URI” errors in SARIF-consuming tools (#844, thanks @chrisc-onaorg) Chores Use public repository URLs for @jscpd/core, @jscpd/finder, @jscpd/tokenizer, @jscpd/html-reporter, @jscpd/badge-reporter, @jscpd/leveldb-store, and @jscpd/redis-store package metadata (#831–#837, thanks @9904099) Add cargo ecosystem to Dependabot config Dependencies Bump askama to 0.16.0 in /rust Bump log to 0.4.33 in /rust Bump env_logger to 0.11.11 in /rust Bump rustc-hash to 2.1.3 in /rust Thanks Big thanks to @laurynas-biveinis, @chrisc-onaorg, and @9904099 for their contributions to this release! 🙌

Version updated for https://github.com/kurehajime/contributor-summary to version v1. This action is used across all versions by 1 repositories. Action Type This is a Node action using Node version 24. Go to the GitHub Marketplace to find the latest changes. What’s Changed 1st Release

Version updated for https://github.com/LiquidLogicLabs/git-action-ca-certificate-import to version v3.0.3. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed 📦 Uncategorized chore: standardize tooling to current playbook chore(release): 3.0.3 Pull Requests #{{PR_LIST}} Usage - uses: LiquidLogicLabs/git-action-ca-certificate-import@v3.0.3 with: certificate: 'path/to/cert.crt' # Auto-detects: file path, URL, or inline content Installation The certificate will be installed to the system CA store and trusted by:

Version updated for https://github.com/logi-camp/conventional-semver to version v1.1.1. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Bug Fixes: BREAKING CHANGE detection in changelog: Fixed an issue where BREAKING CHANGE: footers in commit bodies were not being included in the generated changelog output. Breaking changes are now properly surfaced.

Version updated for https://github.com/mattybellx/Ansede to version v6.0.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed [6.0.0] — 2026-07-08 Added Rust language analyzer (RS-001–006): CWE-119 (unsafe blocks), CWE-798 (hardcoded credentials), CWE-78 (command injection), CWE-327 (weak crypto), CWE-532 (sensitive panics), CWE-362 (TOCTOU) LSP code actions + hover: VS Code now offers one-click fix suggestions via the lightbulb (codeAction) and vulnerability details on hover Live playground at /scan: paste code, see findings — no install required. Available at ansede.onrender.com/scan GitLab CI + Azure DevOps + Jenkins templates in docs/ci-templates/ Adaptive Rules section in README — --suggest documented prominently --all-findings flag: escape hatch to see all findings regardless of confidence Random-repo noise-gate CI: validates 0% HIGH/CRIT false-negative rate on every release fast/full/enterprise extras in pyproject.toml for friendlier optional-dependency names Changed Confidence threshold default: 0.0 → 0.65 — scans now filter low-signal findings by default. CRITICAL/HIGH findings are never suppressed regardless of confidence. Use --all-findings to see everything. post-pr-comments default: false → true in GitHub Action — PRs now get inline security review comments by default Confidence score displayed in text output for findings < 80% confidence OWASP recall badge: 93.3% (unchanged, confirmed) Language count: 5 → 6 (added Rust) Test count: 1,234 → 1,249 Measured Impact (fresh random repos) HIGH/CRITICAL findings lost: 0 out of 790 across 5 diverse codebases Noise reduction: 5–41% depending on codebase maturity (average ~22%) Zero regressions; all 1,249 tests pass Competitive Position (July 2026) #1 CVE Recall: 100% (164/164 across 5 languages) #1 OWASP Recall: 93.3% #2 OWASP Youden Score: +0.8% #1 Language Breadth: 6 languages (Python, JS/TS, Go, Java, C#, Rust) Only SAST with built-in IDOR/auth-bypass/ownership detection

Version updated for https://github.com/mayurrawte/SherlockQA to version v1.2.2. This action is used across all versions by ? repositories. Action Type This is a Node action using Node version 20. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixes the #1 trust-killer from the reliability epic (#19): reviews stacking up on every push until contributors start ignoring the tool. Fixed Reviews no longer pile up on every push (#21) — SherlockQA now recognizes its own prior reviews regardless of the use-emoji setting via a hidden <!-- sherlockqa:review --> marker, and the summary no longer creates an undismissable COMMENTED review. Inline findings are synced, not stacked — posted as individually-tagged review comments that are deleted and re-posted on each run. Formal reviews only for dismissable terminal verdicts (APPROVE / REQUEST_CHANGES) — the common “needs changes” outcome now surfaces via the sticky summary and Check Run instead of an un-dismissable review. With update-summary-comment: false, the legacy single COMMENT review is still posted. Sticky-comment lookup is now paginated (#12) — busy PRs no longer accumulate duplicate sticky comments. Internal Jest suite grown to 24 tests, adding planFormalReview and isSherlockReview regressions. Note: pre-existing COMMENTED review stacks from older versions can’t be removed via the API and will linger once; this release prevents new ones.

Version updated for https://github.com/mishmash-io/setup-telemetry-collection to version v1.0.9. This action is used across all versions by 1 repositories. Action Type This is a Node action using Node version 24. Go to the GitHub Marketplace to find the latest changes. What’s Changed Summary This release updates a number of vulnerable dependencies to their safe versions: transitive undici 5 and 6 bumped to 6.27.0 transitive js-yaml 3 bumped to 3.15.0 transitive js-yaml 4 bumped to 4.3.0 transitive @babel/core bumped to 7.29.6 We strongly advise you to upgrade to this release as soon as possible.

Version updated for https://github.com/pezhik/skilltotal to version v0.34.7. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixed Ruleset 39 — two embedded-secret false positives (closes the tripwire secret sub-cluster) (see RULES_CHANGELOG.md): (1) a secret next to a client-telemetry ingestion URL (*.client-telemetry.<vendor>/enqueue) is a publishable key (Sentry-DSN class) → needs_review, not scored — snowflake-connector-python’s telemetry_oob.py; (2) a testing_utils.py / test_utils.py module is recognised as test-support code so a hardcoded CI token there is demoted — transformers’ src/transformers/testing_utils.py hf_ token. Recall preserved (secret without a telemetry URL, and non-test *_utils.py, still score).

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.31.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Adds three composable, backward-compatible launch knobs (#107) so the harness can grade honestly-built MCP servers that do not boot from a bare declared entry: serverArgs (--server-arg / server_args) — arguments appended to the server command, e.g. a mcp serve subcommand. Recorded in the evidence. serverEnv (--server-env KEY=VALUE / server_env) — startup env the server needs to boot, e.g. an API key. Injected privately like the planted canaries and redacted from the recorded command. entrySubpath (--entry / entry) — a package-relative entry file instead of a declared bin. Resolved inside the staged package root and rejected on traversal. Docker isolation only (npm/github). Setting serverArgs or entrySubpath bypasses bin probing and does a single named launch; the C-02 egress target launches the same way, so it grades the same process. All three are optional and default off (semver-minor).