All pull requests

Pull requests

• chore(release): 5.1.0

  Ready for review
  #2032·Mikola Lysenko (mikolalysenko) opened Nov 6, 2026Collaborator·4 tasks·

  ·
  4

• Keep the in-memory hosted engine off the disk for Go workspaces

  #2031·Mikola Lysenko (mikolalysenko) opened Nov 5, 2026Collaborator·

  ·

• Stop attesting sbt pins a build reassignment or uncommitted wiring bypasses

  Ready for review
  #2030·Mikola Lysenko (mikolalysenko) opened Nov 5, 2026Collaborator·

  ·
  3

• Plan pnpm rewires with one core for both modes (lock-model 2b)

  #2029·Mikola Lysenko (mikolalysenko) opened Nov 5, 2026Collaborator·

  ·
  1

• Fix pdm e2e red on every PR: pin hishel<2

  ci-janitorReady for review
  #2028·Mikola Lysenko (mikolalysenko) opened Nov 5, 2026Collaborator·

  ·
  3

• Move release.yml artifact steps off Node 20 actions

  ci-janitorReady for review
  #2027·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  1

  3

• Withhold Maven pins whose coordinates a profile redefines

  #2026·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  1

• Never read or rewrite project files outside the git repository root

  #2025·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  9

• Withhold a vendored Cargo copy a member's other source bypasses

  #2024·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  1

• Keep vendored artifacts a lock references through escaped paths

  Ready for review
  #2022·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  8

• Stop fetching patch views during hosted scans

  Ready for review
  #2021·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  7

• Resolve Maven pin properties through profiles and nesting

  agent:needs-human
  #2020·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  1

• Stop attesting a Cargo pin a workspace member resolves from crates.io

  #2019·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·

• Never patch a pnpm, yarn or vlt dependency the user patched

  #2018·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·

• Read BOM composer locks and pin that no lock pin drives a download

  Ready for review
  #2017·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  6

• Read Maven checksums.sha256 one way and never drop user lines

  Ready for review
  #2016·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  5

• Refuse vendored patches the same way everywhere

  Ready for review
  #2015·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  2

• Restore the uv 0.2 pins hosted mode writes

  Ready for review
  #2014·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  11

• Stop downloading vlt artifacts during hosted scans

  Ready for review
  #2013·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  2

• Read Cargo members in discovery; match liveness uuids by origin

  agent:needs-human
  #2012·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  9

• Read the governing go.work in Go discovery

  Ready for review
  #2011·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  12

• Stop attesting npm-family pins pnpm or a user patch overrides

  Ready for review
  #2010·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  8

• Read pnpm locks through one walk (lock-model 2a)

  #2009·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  1

• Require sbt resolution evidence before attesting vendored pins

  Ready for review
  #2008·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  5

• Stop attesting NuGet versions the writers refuse

  Ready for review
  #2007·Mikola Lysenko (mikolalysenko) opened Nov 4, 2026Collaborator·

  ·
  3