Setup OpenSSF scorecards and fix issues
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
The issue names no files, tests, or entry points. Start by reviewing the OpenSSF scorecard report and the seven listed advisories, then inspect the taskgraph dependency and CI configuration; done means scorecards are set up and the reported vulnerabilities are resolved or explicitly addressed.
Written by the indexing model from the issue text.
Description
Pulling in Taskcluster via https://github.com/mozilla/neqo/pull/1935 made neqo's OSSF score drop because of unpatched vulnerabilities in taskcluster:
Reason
7 existing vulnerabilities detected
Details
Warn: Project is vulnerable to: GHSA-jjg7-2v4v-x38h
Warn: Project is vulnerable to: GHSA-h5c8-rqwp-cp95
Warn: Project is vulnerable to: GHSA-h75v-3vvj-5mfj
Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56
Warn: Project is vulnerable to: GHSA-34jh-p97f-mpxf
Warn: Project is vulnerable to: GHSA-g4mx-q9vg-27p4 / PYSEC-2023-212
Warn: Project is vulnerable to: GHSA-v845-jxx5-vc9f / PYSEC-2023-192
- Dominant language
- Python
- Stars
- 26
- Forks
- 55
- Avg merge
- 2d 6m
- Merged PRs (30d)
- 15
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from taskcluster/taskgraph
-
Dependency Dashboard Open
Difficulty 5/5 Over a week Newbie friendliness 20/100
taskcluster/taskgraph#952 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
taskcluster/taskgraph#915 ·
-
feature
Difficulty 3/5 1-2 days Newbie friendliness 35/100
taskcluster/taskgraph#911 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
taskcluster/taskgraph#882 ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
taskcluster/taskgraph#865 · 1 comment ·
All issues in taskcluster/taskgraph
Similar issues
-
link-check link-check:sphinx-theme
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
qgis/QGIS-Documentation#11275 ·
-
bug priority:normal ready-for-dev
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
OpenHands/extensions#626 · 1 comment ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
CSCfi/sd-search-api#39 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100