-
# What
Release tags periodically
# Why
There is an upstream dependency in nasa/trick on nasa/koviz for trickops tests it performs in CI. See also [trickops CI definition](https://github.com/n…
-
Chrome bans `eval` totally in MV3
## Use cases
- Use [Secure ECMAScript](https://github.com/endojs/endo/tree/master/packages/ses) to prevent supply chain attacks
- Before the [ShadowRealm](h…
-
- https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_v2.pdf
- https://www.reddit.com/r/linuxupskillchallenge/
AOrps updated
1 month ago
-
### Affected project(s)
- [ ] documentation
- [ ] examples
- [ ] wasmCloud host
- [X] wasmCloud CLI (wash)
- [ ] wasmCloud dashboard UI (washboard)
- [ ] capability providers
- [ ] provider b…
-
One of the packages we're importing has multiple licenses based on dependent projects. The Github dependency-graph API returns all 3 licenses. We have each of the 3 licenses in our `allow-list`, but b…
-
The README.md proposes to install the witness tool using the bash + curl one-liner:
```bash
bash
-
### Problem
> Any software can introduce vulnerabilities into a supply chain. As a system gets more complex, it’s critical to already have checks and best practices in place to guarantee artifact i…
rugk updated
2 months ago
-
[Dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates) automatically bump your dependencies.
R…
-
### Requirement
Hi, I'm Harshita. I’m working with [CNCF and the Google Open Source Security Team for the GSoC 2024 term](https://github.com/cncf/mentoring/issues/1196). We are collaborating to enh…
-
Please consider adding [SLSA provenance](https://slsa.dev/) to your releases, e.g. via [GitHub Artifact attestations](https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-availa…