{
  "history": [
    {
      "added": 0,
      "commit": "55989c640a19aac3cb1c190f97464e59773035c5",
      "date": "2026-11-01",
      "dependencies": 3,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "26.10.0.133078",
      "release_changed": false,
      "release_integrity": "no-assets",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 4.9,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 1,
        "Low": 0,
        "Medium": 0,
        "files": 1
      }
    },
    {
      "added": 0,
      "commit": "55989c640a19aac3cb1c190f97464e59773035c5",
      "date": "2026-11-02",
      "dependencies": 3,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "kev": null,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "26.10.0.133078",
      "release_changed": false,
      "release_integrity": "no-assets",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 4.9,
      "scorecard_date": "2026-10-26",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 0,
      "workflow": {
        "High": 1,
        "Low": 0,
        "Medium": 0,
        "files": 1
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Static Application Security Testing (SAST) \u203a Multi-language",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "26.10.0.133078",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "55989c640a19aac3cb1c190f97464e59773035c5",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v6.0.2",
        "version": "v6.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yml",
        "name": "jdx/mise-action",
        "purl": "pkg:github/jdx/mise-action@v4.0.1",
        "version": "v4.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yml",
        "name": "SonarSource/ci-github-actions/build-gradle",
        "purl": "pkg:github/SonarSource/ci-github-actions@v1.3.24#build-gradle",
        "version": "v1.3.24"
      }
    ],
    "description": "Inspect code continuously for quality and security issues",
    "errors": [],
    "id": "SonarSource__sonarqube",
    "manifests": [
      ".github/workflows/build.yml",
      "build.gradle",
      "plugins/build.gradle",
      "plugins/sonar-education-plugin/build.gradle",
      "plugins/sonar-xoo-plugin/build.gradle",
      "server/build.gradle",
      "server/sonar-alm-client/build.gradle",
      "server/sonar-auth-bitbucket/build.gradle",
      "server/sonar-auth-common/build.gradle",
      "server/sonar-auth-github/build.gradle",
      "server/sonar-auth-gitlab/build.gradle",
      "server/sonar-auth-ldap/build.gradle",
      "server/sonar-auth-saml/build.gradle",
      "server/sonar-ce-common/build.gradle",
      "server/sonar-ce-task-projectanalysis/build.gradle",
      "server/sonar-ce-task/build.gradle",
      "server/sonar-ce/build.gradle",
      "server/sonar-db-dao/build.gradle",
      "server/sonar-db-migration/build.gradle",
      "server/sonar-db-profiling/build.gradle",
      "server/sonar-events/build.gradle",
      "server/sonar-main/build.gradle",
      "server/sonar-process/build.gradle",
      "server/sonar-server-common/build.gradle",
      "server/sonar-statemachine/build.gradle",
      "server/sonar-telemetry-core/build.gradle",
      "server/sonar-telemetry/build.gradle",
      "server/sonar-webserver-api/build.gradle",
      "server/sonar-webserver-auth/build.gradle",
      "server/sonar-webserver-common/build.gradle",
      "server/sonar-webserver-core/build.gradle",
      "server/sonar-webserver-es/build.gradle",
      "server/sonar-webserver-monitoring/build.gradle",
      "server/sonar-webserver-pushapi/build.gradle",
      "server/sonar-webserver-webapi-v2/build.gradle",
      "server/sonar-webserver-webapi/build.gradle",
      "server/sonar-webserver-ws/build.gradle",
      "server/sonar-webserver/build.gradle",
      "sonar-application/build.gradle",
      "sonar-core/build.gradle",
      "sonar-duplications/build.gradle",
      "sonar-markdown/build.gradle",
      "sonar-plugin-api-impl/build.gradle",
      "sonar-sarif/build.gradle",
      "sonar-shutdowner/build.gradle",
      "sonar-ws-generator/build.gradle",
      "sonar-ws/build.gradle"
    ],
    "name": "sonarqube",
    "osv": {
      "advisories": 0,
      "available": true,
      "confirmed": 0,
      "osv_only": [],
      "warning": null
    },
    "ref": "26.10.0.133078",
    "ref_kind": "release",
    "release_integrity": {
      "assets": 0,
      "checksums_published": false,
      "methods": [],
      "provenance_published": false,
      "sbom_published": false,
      "signatures_published": false,
      "verdict": "no-assets"
    },
    "released_at": "2026-10-12T10:01:25Z",
    "repository": "SonarSource/sonarqube",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 4 shared packages \u2014 no actual upgrades"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:08:37+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Binary-Artifacts",
          "reason": "binaries present in source code",
          "score": 0
        },
        {
          "name": "CII-Best-Practices",
          "reason": "no effort to earn an OpenSSF best practices badge detected",
          "score": 0
        },
        {
          "name": "Code-Review",
          "reason": "Found 0/30 approved changesets -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "SAST",
          "reason": "no SAST tool detected",
          "score": 0
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file not detected",
          "score": 0
        },
        {
          "name": "Branch-Protection",
          "reason": "branch protection is not maximal on development and all release branches",
          "score": 5
        },
        {
          "name": "Token-Permissions",
          "reason": "detected GitHub workflow tokens with excessive permissions",
          "score": 9
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "all dependencies are pinned",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow not detected",
          "score": -1
        },
        {
          "name": "Signed-Releases",
          "reason": "no releases found",
          "score": -1
        }
      ],
      "date": "2026-10-26",
      "score": 4.9,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [],
    "workflow_audit": {
      "files": 1,
      "findings": [
        {
          "confidence": "High",
          "description": "unpinned image references",
          "file": ".github/workflows/build.yml",
          "line": 25,
          "note": "container image uses the floating 'latest' tag",
          "rule": "unpinned-images",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-images"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}