Corrections and manual overrides
Everything a person changed about what the report scans or publishes, with when and why. Automated results are never edited by hand; when a week is re-run, the earlier run is kept.
Release tag pins
Monorepos whose latest GitHub release is not the catalogued tool are scanned at the newest release matching a pattern.
| Since | Repository | Tag pattern | Reason | Source |
|---|---|---|---|---|
| 2026-11-01 | cloudquery/cloudquery | ^cli-v | The repository releases dozens of plugins; the catalog entry is the CLI. | PR #44 |
| 2026-11-01 | external-secrets/external-secrets | ^v[0-9] | Helm chart releases share the repository with application releases. | PR #44 |
| 2026-11-01 | RustSec/rustsec | ^cargo-audit/ | The catalog entry is cargo-audit; the repository also releases platforms, cvss, and cargo-lock crates. | PR #44 |
Catalog exceptions
Tools kept in an active category although the automated rules would classify them otherwise.
None.
Re-run weeks
A week published more than once. The replaced run summary remains available.
None.
Disputed findings
Matches reported as wrong, not applicable, or fixed, and how each report was resolved. The match stays in the data and is annotated on the project page.
None.
Scan method changes
Changes to how projects are scanned. The first week scanned after a change differs from the week before mostly because of the change, and is marked on the report.
| Week | Change | Source |
|---|---|---|
| 2026-11-02 | npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. | PR #54 |
Other corrections
Data or methodology corrections not covered above.
| Date | Scope | Correction | Source |
|---|---|---|---|
| 2026-11-02 | Week of 2026-11-01 | A review of the first week found scanner errors, fixed from the week of 2026-11-02: two critical "Malware in ..." matches were false (salesforce/cloudsplaining's own npm package name and a local file: dependency in semgrep/semgrep matched malware published under the same names), four snyk/cli matches were on its own 1.0.0-monorepo workspace package, and 17 matches were on GitHub Actions referenced by a moving tag (v4, release/v1) that follows the latest, fixed release; npm development dependencies were omitted although the method includes them; npm-shrinkwrap.json was not read (AikidoSec/safe-chain showed 7 dependencies); and directories such as integration-tests, test-fixtures, and functional-tests were not excluded as fixtures. The 2026-11-01 data is unchanged; its "changes since last week" compared same-day re-runs and is now shown as a first scan. | PR #54 · details |
| 2026-11-01 | Week of 2026-11-01 | The first week was published seven times by scheduled, manual, and push-triggered runs while the report pipeline was being finished. Each publish replaced the previous one without keeping it; every version remains in the supply-chain-data branch history. From 2026-11-08 only scheduled or explicitly dispatched runs publish, and a replaced run is kept under runs/superseded/. | details |