Issues

• Main module with a (devel) or v0.0.0 pseudo-version is flagged with all of its own advisories

  temporalio/deputy#416 · Filter by author picatz opened on Oct 29, 2026

• [Bug] diff_report policies can’t use changes

  bug
  temporalio/deputy#414 · Filter by author scottlaird opened on Oct 27, 2026

• [Bug] deputy scan writes no report when a policy denies

  bug
  temporalio/deputy#413 · Filter by author scottlaird opened on Oct 27, 2026

• scan action: policy deny writes no SARIF, so the job summary says "No vulnerabilities found"

  temporalio/deputy#412 · Filter by author picatz opened on Oct 27, 2026

• diff --licenses reports no license for GitHub Actions and Go stdlib under the default deps.dev source

  temporalio/deputy#411 · Filter by author picatz opened on Oct 27, 2026

• Flag end-of-life OS distributions in container and Dockerfile scans

  temporalio/deputy#410 · Filter by author picatz opened on Oct 27, 2026

• Directory scans: optionally scan the base images that Dockerfiles reference

  temporalio/deputy#409 · Filter by author picatz opened on Oct 27, 2026

• [Bug] diff_report policied get every finding in the target ref, not the ones the diff introduced

  bug
  temporalio/deputy#408 · Filter by author scottlaird opened on Oct 26, 2026

• [Bug] Go pseudo-versions are matched against release-branch fix versions, so a build from main is reported as vulnerable to bugs it has already fixed

  bug
  temporalio/deputy#407 · Filter by author scottlaird opened on Oct 23, 2026
  1

• [Feature Request] deputy does not support running in jj repos

  enhancement
  temporalio/deputy#406 · Filter by author scottlaird opened on Oct 22, 2026
  2

• --ignore-unfixed hides malware, which never has a fix

  bugsecurity
  temporalio/deputy#405 · Filter by author picatz opened on Oct 9, 2026

• Malware advisories without a MAL- id are classified as vulnerabilities

  bugsecurity
  temporalio/deputy#404 · Filter by author picatz opened on Oct 9, 2026

• buf.gen.yaml leaves remote plugins unpinned, so buf generate now emits connect-go v2 code

  bugdependencies
  temporalio/deputy#403 · Filter by author picatz opened on Oct 9, 2026

• MCP diff_refs with baseRef HEAD compares the working tree with itself

  bugdiffmcp
  temporalio/deputy#402 · Filter by author picatz opened on Oct 9, 2026

• deputy diff cannot resolve refs inside a linked Git worktree

  bugdiff
  temporalio/deputy#401 · Filter by author picatz opened on Oct 9, 2026

• scan <Dockerfile> fails with "unsupported target type" (scan router has no Dockerfile case)

  temporalio/deputy#400 · Filter by author ctfjake opened on Oct 4, 2026

• scan sbom fails with "no provider matched target" (no SBOM target provider is registered)

  temporalio/deputy#399 · Filter by author ctfjake opened on Oct 4, 2026

• Proxy: SSRF protections in the upstream dialer before the shared-service mode

  proxysecurity
  temporalio/deputy#392 · Filter by author picatz opened on Sep 18, 2026

• Proxy: inject registry credentials so private registries work behind the proxy without secrets in the job

  enhancementproxysecurity
  temporalio/deputy#391 · Filter by author picatz opened on Sep 18, 2026

• Proxy: a forward-proxy mode with a per-job CA and an egress allowlist, for CI enforcement

  enhancementproxysecurity
  temporalio/deputy#390 · Filter by author picatz opened on Sep 18, 2026

• The publish-date filters are accepted by four commands and applied by none

  bug
  temporalio/deputy#384 · Filter by author picatz opened on Sep 15, 2026

• Diff: flag one module required at different versions across manifests in the same tree

  diffenhancement
  temporalio/deputy#383 · Filter by author picatz opened on Sep 14, 2026

• Scan action: name the denied rule, reason, and packages in the failure annotation and job summary

  enhancement
  temporalio/deputy#382 · Filter by author picatz opened on Sep 14, 2026

• Add a Dependabot config so multi-module bumps land as one PR and version updates get a cooldown

  enhancementsecurity
  temporalio/deputy#381 · Filter by author picatz opened on Sep 14, 2026
  1

• Ecosystem capability flags are a hand-maintained list that has drifted from the code

  bug
  temporalio/deputy#380 · Filter by author picatz opened on Sep 14, 2026