Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

1h ago

#3483

Workflow run cancellation on concurrency-key conflict

2h ago

#3480

Read non-string sensitive resource fields back with their type

3h ago

#3473

Retention: one timeframe, enforced automatically, after which nothing older remains anywhere in the datastore

4h ago

#3470

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

4h ago

#3469

Docs: add PowerShell to Set Up Shell Completions

4h ago

#3466

Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

4h ago

#3464

extension quality --json reports status "failed" when a rubric factor is missing, though the exit code is 0

5h ago

#3463

auth whoami: log mode labels collectives Free and shows trial expired for a superseded trial

s4h ago

#3453

Docs: extension quality now reports repository-verified for private source hosting (swamp-club#3406)

6h ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

4h ago

#3404

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

1d ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

1d ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

16h ago

#3395

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

1d ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

1d ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s1d ago

#3390

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

1d ago

#3383

extension pull: safety analysis scans the bundle the extension runs

1d ago

#3382

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

1d ago

#3378

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

1d ago

#3377

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

1d ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

1d ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

1d ago

#3354

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

1d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

1d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

1d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

1d ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

1d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

2d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

2d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

2d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

2d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

2d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

2d ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

2d ago

#3231

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

4d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

4d ago

#3214

Show wait keys and pending signals to remote clients and the dashboard

5d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

5d ago

#3204

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

6d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

6d ago

#3193

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

6d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

6d ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

7d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

7d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

8d ago

#3073

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

8d ago

#3065

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

8d ago

#3060

Decide a stricter naming rule for workflow step and job names

8d ago

← Back to list

01Issue

FeatureOpenSwamp ClubPublic

AssigneesNone

Relationships

#3486 Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

Opened by skunk-ape · 10/14/2026

What changed

The dependency trust audit no longer only becomes 'not audited' when a lookup fails. Both the registry scorecard (swamp-club#3351) and the CLI's extension push and quality (swamp-club#3439, released in v20261014.220449.0-sha.79e0800b) resolve each npm specifier to one exact version before querying OSV.dev:

an exact version is used as-is;
a range resolves to the highest published version that satisfies it;
a dist-tag resolves through the packument's dist-tags;
no version resolves to dist-tags.latest.

When nothing resolves, the dependency is not audited with the reason 'OSV not queried (no published version matches )'. When the npm registry is unreachable, only an exact version is still queried; anything else is 'OSV not queried (no resolvable version)'. The CLI's audit summary version is the resolved version.

Pages to update

content/manual/explanation/extension-trust.md: the not-audited paragraph says only that a failed OSV or npm lookup makes a package not audited. Add that OSV is asked about the resolved version, and that a specifier no published version matches is also not audited.
content/manual/reference/extensions/publishing.md (not-audited section, around the extension quality example): mention the no-matching-version reason alongside the failed-lookup reasons.
Optionally content/manual/how-to/extensions/improve-score.md ('Rescore a dependency that was not audited'): re-running does not help when no published version matches; the fix is to change the specifier.

02Bog Flow

Open

10/14/2026, 10:29:44 PM

No activity in this phase yet.

03Sludge Pulse

system commented 10/14/2026, 10:29:44 PM

Classified automatically when this issue was filed.

Source: Swamp Club

If you feel this classification is incorrect, add a ripple to tell us so.