| Package | Version | Score | Details |
|---|
| gomod/github.com/hashicorp/go-version | 1.8.0 |
🟢 6.6 | Details| Check | Score | Reason |
|---|
| Code-Review | 🟢 7 | Found 8/11 approved changesets -- score normalized to 7 | | Packaging | ⚠️ -1 | packaging workflow not detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Maintained | 🟢 7 | 9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7 | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | 🟢 6 | branch protection is not maximal on development and all release branches | | SAST | ⚠️ 0 | SAST tool is not run on all commits -- score normalized to 0 |
|
| gomod/go.opentelemetry.io/collector/component | 1.49.0 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | ⚠️ 0 | dangerous workflow patterns detected | | Dependency-Update-Tool | 🟢 10 | update tool detected | | Code-Review | 🟢 10 | all changesets reviewed | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | 🟢 5 | badge detected: Passing | | SAST | 🟢 9 | SAST tool detected but not run on all commits | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Packaging | 🟢 10 | packaging workflow detected | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | Fuzzing | 🟢 10 | project is fuzzed | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | CI-Tests | 🟢 10 | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 | | Contributors | 🟢 10 | project has 45 contributing companies or organizations |
|
| gomod/go.opentelemetry.io/collector/extension | 1.49.0 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | ⚠️ 0 | dangerous workflow patterns detected | | Dependency-Update-Tool | 🟢 10 | update tool detected | | Code-Review | 🟢 10 | all changesets reviewed | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | 🟢 5 | badge detected: Passing | | SAST | 🟢 9 | SAST tool detected but not run on all commits | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Packaging | 🟢 10 | packaging workflow detected | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | Fuzzing | 🟢 10 | project is fuzzed | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | CI-Tests | 🟢 10 | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 | | Contributors | 🟢 10 | project has 45 contributing companies or organizations |
|
| gomod/go.opentelemetry.io/collector/extension/xextension | 0.143.0 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | ⚠️ 0 | dangerous workflow patterns detected | | Dependency-Update-Tool | 🟢 10 | update tool detected | | Code-Review | 🟢 10 | all changesets reviewed | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | 🟢 5 | badge detected: Passing | | SAST | 🟢 9 | SAST tool detected but not run on all commits | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Packaging | 🟢 10 | packaging workflow detected | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | Fuzzing | 🟢 10 | project is fuzzed | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | CI-Tests | 🟢 10 | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 | | Contributors | 🟢 10 | project has 45 contributing companies or organizations |
|
| gomod/go.opentelemetry.io/collector/featuregate | 1.49.0 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | ⚠️ 0 | dangerous workflow patterns detected | | Dependency-Update-Tool | 🟢 10 | update tool detected | | Code-Review | 🟢 10 | all changesets reviewed | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | 🟢 5 | badge detected: Passing | | SAST | 🟢 9 | SAST tool detected but not run on all commits | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Packaging | 🟢 10 | packaging workflow detected | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | Fuzzing | 🟢 10 | project is fuzzed | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | CI-Tests | 🟢 10 | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 | | Contributors | 🟢 10 | project has 45 contributing companies or organizations |
|
| gomod/go.opentelemetry.io/collector/pdata | 1.49.0 |
🟢 7.6 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | ⚠️ 0 | dangerous workflow patterns detected | | Dependency-Update-Tool | 🟢 10 | update tool detected | | Code-Review | 🟢 10 | all changesets reviewed | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Pinned-Dependencies | 🟢 10 | all dependencies are pinned | | CII-Best-Practices | 🟢 5 | badge detected: Passing | | SAST | 🟢 9 | SAST tool detected but not run on all commits | | License | 🟢 10 | license file detected | | Signed-Releases | ⚠️ -1 | no releases found | | Packaging | 🟢 10 | packaging workflow detected | | Security-Policy | 🟢 10 | security policy file detected | | Branch-Protection | 🟢 4 | branch protection is not maximal on development and all release branches | | Fuzzing | 🟢 10 | project is fuzzed | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | CI-Tests | 🟢 10 | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 | | Contributors | 🟢 10 | project has 45 contributing companies or organizations |
|
| gomod/google.golang.org/genproto/googleapis/api | 0.0.0-20251029180050-ab9386a59fda |
🟢 6.6 | Details| Check | Score | Reason |
|---|
| Packaging | ⚠️ -1 | packaging workflow not detected | | Maintained | 🟢 10 | 11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Code-Review | 🟢 10 | all changesets reviewed | | Security-Policy | 🟢 10 | security policy file detected | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | SAST | ⚠️ 1 | SAST tool is not run on all commits -- score normalized to 1 |
|
| gomod/google.golang.org/genproto/googleapis/rpc | 0.0.0-20251029180050-ab9386a59fda |
🟢 6.6 | Details| Check | Score | Reason |
|---|
| Packaging | ⚠️ -1 | packaging workflow not detected | | Maintained | 🟢 10 | 11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Code-Review | 🟢 10 | all changesets reviewed | | Security-Policy | 🟢 10 | security policy file detected | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Token-Permissions | ⚠️ 0 | detected GitHub workflow tokens with excessive permissions | | Fuzzing | ⚠️ 0 | project is not fuzzed | | License | 🟢 10 | license file detected | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | Signed-Releases | ⚠️ -1 | no releases found | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | SAST | ⚠️ 1 | SAST tool is not run on all commits -- score normalized to 1 |
|
| gomod/google.golang.org/grpc | 1.78.0 |
🟢 7.9 | Details| Check | Score | Reason |
|---|
| Maintained | 🟢 10 | 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 | | Dangerous-Workflow | 🟢 10 | no dangerous workflow patterns detected | | Packaging | ⚠️ -1 | packaging workflow not detected | | Code-Review | 🟢 10 | all changesets reviewed | | Security-Policy | 🟢 9 | security policy file detected | | CII-Best-Practices | ⚠️ 0 | no effort to earn an OpenSSF best practices badge detected | | Token-Permissions | 🟢 10 | GitHub workflow tokens follow principle of least privilege | | Binary-Artifacts | 🟢 10 | no binaries found in the repo | | License | 🟢 10 | license file detected | | Fuzzing | 🟢 10 | project is fuzzed | | Signed-Releases | ⚠️ 0 | Project has not signed or included provenance with any releases. | | Branch-Protection | ⚠️ -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md | | Pinned-Dependencies | ⚠️ 0 | dependency not pinned by hash detected -- score normalized to 0 | | Vulnerabilities | 🟢 10 | 0 existing vulnerabilities detected | | SAST | 🟢 7 | SAST tool detected but not run on all commits |
|
| gomod/google.golang.org/protobuf | 1.36.11 |
Unknown | Unknown |