-
Thank you SO MUCH for your work on the "Principles for Package Repository Security".
Today several of us brainstormed about ways to possible improve it, as part of the CISA OSS Summit. Below are no…
-
Example:
```
[INFO] --------------------< org.apache.maven:maven-core >---------------------
[INFO] Building Maven Core 4.0.0-beta-3-SNAPSHOT [28/34]
[INFO] from maven-cor…
-
## What happens
```console
$ go-libyear --go-list ./go.mod
Error: private module path: 'example.com/module' cannot be handled by any supported VCS [git]
```
where `example.com/module` is an int…
-
I got the panic bellow on two projects.
Now both of those projects use cgo and a modules in private repositories in go.mod. Bu I'm pretty sure that the modules in private repositories are at fault as…
-
`--releases` flag fails when a release date cannot be found (because gem is private and not in rubygems.org)
```
libyear-bundler --releases
/Users/richardgrey/.gem/ruby/3.0.2/gems/json-2.6.1/li…
rgrey updated
3 months ago
-
Hi there,
First of all, thank you for creating and maintaining this gem!
Secondly, I think I found an issue with the total sum of libyears for a pretty regular Rails application. It may be rela…
-
As a package maintainer, I want to have a flag that only outputs the number of lib years, so that as a package maintainer I can rank my packages on how far behind they are and decide which to update f…
-
**Steps to reproduce**
I apologize in advance that this might be tricky to reproduce.
We have a microservice setup, with individual git repos for each service (which then also has their own sln an…
-
Leon: I just realized that you can't go back in time to calculate libyears, at least not with our current tools. You'd need to pass a reference date that would be used like "only consider releases on …
-
Ruby and bundler are important dependencies. The current version of bundler can be ascertained from the end of `Gemfile.lock`. We can find the current Ruby version either in `Gemfile`, in `.ruby-versi…