temporalio/deputy

View on GitHub

Stars: 34
Forks: 8
Open beginner issues: 5
Indexed issues: 263
Avg merge: 5d 15h
Merged PRs (30d): 3

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 11, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

263 open issues indexed

Proxy: SSRF protections in the upstream dialer before the shared-service mode Open

proxy security

Difficulty 4/5 3-5 days Newbie friendliness 58/100

temporalio/deputy#392 · Opened Sep 18, 2026
Proxy: inject registry credentials so private registries work behind the proxy without secrets in the job Open

enhancement proxy security

Difficulty 5/5 Over a week Newbie friendliness 35/100

temporalio/deputy#391 · Opened Sep 18, 2026
Proxy: a forward-proxy mode with a per-job CA and an egress allowlist, for CI enforcement Open

enhancement proxy security

Difficulty 5/5 Over a week Newbie friendliness 35/100

temporalio/deputy#390 · Opened Sep 18, 2026
The publish-date filters are accepted by four commands and applied by none Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

temporalio/deputy#384 · Opened Sep 15, 2026
Diff: flag one module required at different versions across manifests in the same tree Open

diff enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

temporalio/deputy#383 · Opened Sep 14, 2026
Scan action: name the denied rule, reason, and packages in the failure annotation and job summary Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 55/100

temporalio/deputy#382 · Opened Sep 14, 2026
Add a Dependabot config so multi-module bumps land as one PR and version updates get a cooldown Open

enhancement security

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

temporalio/deputy#381 · Opened Sep 14, 2026
Ecosystem capability flags are a hand-maintained list that has drifted from the code Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

temporalio/deputy#380 · Opened Sep 14, 2026
The Go standard library has no license in the inventory, so every go-directive bump trips the license policy Open

bug inventory

Difficulty 3/5 1-2 days Newbie friendliness 68/100

temporalio/deputy#379 · Opened Sep 14, 2026
Graph: add a Composer edge resolver so PHP projects get dependency edges Open

enhancement inventory

Difficulty 3/5 1-2 days Newbie friendliness 72/100

temporalio/deputy#378 · Opened Sep 14, 2026
Proxy: add a crates.io ecosystem Open

enhancement proxy

Difficulty 4/5 3-5 days Newbie friendliness 65/100

temporalio/deputy#377 · Opened Sep 14, 2026
Proxy: add a Packagist ecosystem Open

enhancement proxy

Difficulty 4/5 3-5 days Newbie friendliness 55/100

temporalio/deputy#376 · Opened Sep 14, 2026
Proxy: add a NuGet ecosystem Open

enhancement proxy

Difficulty 4/5 3-5 days Newbie friendliness 68/100

temporalio/deputy#375 · Opened Sep 14, 2026
Proxy: add a Maven Central ecosystem Open

enhancement proxy

Difficulty 4/5 3-5 days Newbie friendliness 64/100

temporalio/deputy#374 · Opened Sep 14, 2026
Per-step failures stream the plan's terminal FAILED phase even when stop_on_error is false Open

bug

Difficulty 5/5 Over a week Newbie friendliness 42/100

temporalio/deputy#367 · Opened Sep 11, 2026
Dry run accepts an execution directory the process cannot enter, so preflight passes a step execution would refuse Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 68/100

temporalio/deputy#366 · Opened Sep 11, 2026
--ref cannot resolve branches, remote refs, or commits from inside a linked git worktree Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 75/100

temporalio/deputy#365 · Opened Sep 11, 2026
A policy deny suppresses the scan report, so --output writes nothing and CI can only say exit code 1 Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 68/100

temporalio/deputy#364 · Opened Sep 11, 2026
Go toolchain fix step targets the root go.mod even when the vulnerable directive is in a nested module Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 78/100

temporalio/deputy#359 · Opened Sep 11, 2026
Fix planner merges per-advisory targets into a version another advisory still affects Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 66/100

temporalio/deputy#358 · Opened Sep 11, 2026
scan.exclude_paths is silently dropped when a flag corrects an unrelated config value Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

temporalio/deputy#354 · Opened Aug 27, 2026
Config wiring runs before validation so a refused command can still build an OTel exporter Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

temporalio/deputy#353 · Opened Aug 27, 2026
Policy cannot ask who owns a target, so tenant isolation is written as substring matching Open

enhancement policy security

Difficulty 5/5 Over a week Newbie friendliness 25/100

temporalio/deputy#352 · Opened Aug 27, 2026
Compound SPDX expressions and non-SPDX labels are written to license.id, so the document fails schema validation Open

bug inventory

Difficulty 3/5 1-2 days Newbie friendliness 72/100

temporalio/deputy#351 · Opened Aug 27, 2026
Maven purls join groupId and artifactId with a colon and omit the namespace, so they are not valid maven purls Open

bug inventory

Difficulty 3/5 1-2 days Newbie friendliness 78/100

temporalio/deputy#350 · 1 comment · Opened Aug 26, 2026
The Go toolchain is pkg:golang/go on the image path and pkg:golang/stdlib on the repo path, so advisory lookups miss Open

bug go inventory

Difficulty 3/5 1-2 days Newbie friendliness 68/100

temporalio/deputy#349 · Opened Aug 26, 2026
SBOM components carry no hashes, and the available digests do not all describe the component Open

enhancement inventory

Difficulty 4/5 3-5 days Newbie friendliness 45/100

temporalio/deputy#348 · Opened Aug 26, 2026
Version is hardcoded to 0.0.0-dev, which lands in SBOM tool metadata Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 72/100

temporalio/deputy#347 · Opened Aug 26, 2026
--ecosystems maven fails with unknown plugin maven, and the java alias fails over MCP Open

bug inventory mcp

Difficulty 4/5 3-5 days Newbie friendliness 72/100

temporalio/deputy#346 · Opened Aug 26, 2026
gradle-sandbox extracts from a container that always exits non-zero, so a real failure is indistinguishable from success Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

temporalio/deputy#345 · 1 comment · Opened Aug 26, 2026
gradle-sandbox resolves every configuration of every project, including sample fixtures Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 48/100

temporalio/deputy#344 · Opened Aug 26, 2026
gradle-sandbox collects the resolving configuration name and then discards it Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 74/100

temporalio/deputy#343 · Opened Aug 26, 2026
The SBOM writer links every component to the root, so no output has a dependency hierarchy Open

enhancement inventory

Difficulty 4/5 3-5 days Newbie friendliness 55/100

temporalio/deputy#342 · Opened Aug 26, 2026
Nodes never set PrimaryPurpose, so every SBOM component serializes as type application Open

bug inventory

Difficulty 4/5 3-5 days Newbie friendliness 48/100

temporalio/deputy#341 · Opened Aug 26, 2026
Go components are named after the last path segment, so thirteen of them are called v2 and the module path is absent Open

bug go inventory

Difficulty 4/5 3-5 days Newbie friendliness 52/100

temporalio/deputy#340 · Opened Aug 26, 2026
Ignore rules match one advisory ID, so a suppression breaks when the reported alias changes Open

bug enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

temporalio/deputy#339 · Opened Aug 26, 2026
No CI gate runs gofmt or go vet, so 40 files on main are unformatted Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 74/100

temporalio/deputy#337 · Opened Aug 26, 2026
The renderers ignore warnings, so four commands each print them their own way Open

bug enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

temporalio/deputy#336 · Opened Aug 26, 2026
Warnings are flat strings, so one fact about several subjects repeats per subject Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

temporalio/deputy#335 · Opened Aug 26, 2026
Enrichment is vulnerability-shaped: sources should contribute package, repository, and maintainer metadata across every surface Open

enhancement inventory policy

Difficulty 5/5 Over a week Newbie friendliness 35/100

temporalio/deputy#334 · Opened Aug 26, 2026
One plugin transport: ConnectRPC over Unix socket or TLS, retire pluginrpc Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

temporalio/deputy#333 · Opened Aug 26, 2026
Adding a proxy ecosystem takes ten hand edits across five registries Open

enhancement proxy

Difficulty 5/5 Over a week Newbie friendliness 35/100

temporalio/deputy#332 · 1 comment · Opened Aug 26, 2026
Proxy allow/deny decisions vanish at the log line: give them a proto contract and a sink Open

enhancement policy proxy

Difficulty 5/5 Over a week Newbie friendliness 45/100

temporalio/deputy#331 · 1 comment · Opened Aug 26, 2026
The proxy path drops Advisory.kind, so malware findings arrive as ordinary vulnerabilities Open

bug policy proxy security

Difficulty 3/5 1-2 days Newbie friendliness 76/100

temporalio/deputy#330 · Opened Aug 26, 2026
The policy spec documents request.has_version and request.raw_version, which do not exist Open

bug documentation policy

Difficulty 3/5 1-2 days Newbie friendliness 76/100

temporalio/deputy#329 · Opened Aug 26, 2026
Proxy binding profiles advertise a licenses variable that never populates and omit the pkg variable that does Open

bug policy proxy

Difficulty 3/5 1-2 days Newbie friendliness 74/100

temporalio/deputy#328 · Opened Aug 26, 2026
The npm wrapper disables TLS verification for the entire wrapped command Open

bug proxy security

Difficulty 1/5 Under an hour Newbie friendliness 90/100

temporalio/deputy#327 · Opened Aug 26, 2026
Establish a verified per-client mediation matrix: which installs actually flow through the proxy Open

enhancement proxy security

Difficulty 5/5 Over a week Newbie friendliness 42/100

temporalio/deputy#326 · 1 comment · Opened Aug 26, 2026
PyPI downloads bypass the proxy: the simple index hands clients absolute upstream URLs Open

bug proxy security

Difficulty 4/5 3-5 days Newbie friendliness 48/100

temporalio/deputy#325 · 1 comment · Opened Aug 26, 2026
The proxy drops advisory warnings and caches the incomplete result, so policy allows on absent data Open

bug proxy security

Difficulty 4/5 3-5 days Newbie friendliness 48/100

temporalio/deputy#324 · Opened Aug 26, 2026

temporalio/deputy

Get new issues in your inbox