{"resources":{"depsdev":{"id":"depsdev","name":"depsdev","fields":{"package":{"name":"package","type":"\u001bdepsdev.package","title":"deps.dev Go package metadata","desc":"Go module's pinned version, the full version history with publication dates and licenses, the latest published version and its timestamp, and the link to the upstream source project. Useful for stale-dependency, lagging-patch, and license audits. Select a package by its module path, for example depsdev.package(name: \"github.com/rs/zerolog\").","provider":"go.mondoo.com/mql/v13/providers/depsdev","is_implicit_resource":true},"packageVersion":{"name":"packageVersion","type":"\u001bdepsdev.packageVersion","title":"deps.dev package version","desc":"Single published release of a package, carrying its version string, publication timestamp, declared SPDX licenses, the registries it was published to, and any SLSA build provenance attestations. Compare publishedAt across a package's version history for lagging-patch and stale-dependency audits, and check whether a release ships verified build provenance.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/depsdev","is_implicit_resource":true},"packages":{"name":"packages","type":"\u0019\u001bdepsdev.package","title":"List of packages from go.mod direct dependencies","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"project":{"name":"project","type":"\u001bdepsdev.project","title":"deps.dev upstream source project (GitHub / GitLab repository)","desc":"Upstream source repository that deps.dev associates with a package: its description, homepage, SPDX license, archived state, and social-proof signals (stars, forks, open-issue count), along with the OpenSSF Scorecard results. Feeds supply-chain risk policies that flag unmaintained or archived dependencies and low-scorecard libraries. Select a project by its repository identifier, for example depsdev.project(id: \"github.com/rs/zerolog\").","provider":"go.mondoo.com/mql/v13/providers/depsdev","is_implicit_resource":true},"relatedProject":{"name":"relatedProject","type":"\u001bdepsdev.relatedProject","title":"deps.dev package version related project","desc":"Link from a package version to a project that deps.dev associates with it, such as its source repository, issue tracker, or origin. The relationType records what kind of link it is and relationProvenance records how deps.dev determined it, so supply-chain policies can confirm a package points at the source repository it claims. The project resolves to the upstream project record with its OpenSSF Scorecard and repository signals.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/depsdev","is_implicit_resource":true},"scorecard":{"name":"scorecard","type":"\u001bdepsdev.scorecard","title":"OpenSSF Scorecard data from deps.dev","desc":"Automated supply-chain security assessment that OpenSSF Scorecard runs against a project's source repository, surfaced through deps.dev. The overallScore aggregates the individual checks (each listed in checks) that probe practices such as branch protection, code review, dependency pinning, signed releases, and continuous integration testing, producing a single 0-10 rating you can gate dependency adoption on. Inspect date to confirm how recent the evaluation is before relying on the score.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/depsdev","is_implicit_resource":true},"scorecardCheck":{"name":"scorecardCheck","type":"\u001bdepsdev.scorecardCheck","title":"OpenSSF Scorecard individual check","desc":"A single automated OpenSSF Scorecard check evaluating one supply-chain security practice of the project, such as branch protection, code review, or dependency pinning. Selected within a scorecard by the check name, for example name == \"Code-Review\" or name == \"Maintained\". The score and reason record how the project fared against that specific check.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/depsdev","is_implicit_resource":true}},"title":"deps.dev dependency catalog","desc":"Direct dependencies of a project resolved through the deps.dev API, each enriched with version history, upstream project metadata, and OpenSSF Scorecard data. Currently covers Go module dependencies parsed from go.mod. The packages field lists one entry per direct dependency, the starting point for stale-dependency, lagging-patch, license, and supply-chain risk audits.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"depsdev.package":{"id":"depsdev.package","name":"depsdev.package","fields":{"currentVersion":{"name":"currentVersion","type":"\u0007","is_mandatory":true,"title":"Version from go.mod","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"latestPublished":{"name":"latestPublished","type":"\t","title":"Timestamp of the latest published version","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"latestVersion":{"name":"latestVersion","type":"\u0007","title":"Latest published version string","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Go module path","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"project":{"name":"project","type":"\u001bdepsdev.project","title":"Related source project (e.g. GitHub repository)","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"versions":{"name":"versions","type":"\u0019\u001bdepsdev.packageVersion","title":"All known versions","provider":"go.mondoo.com/mql/v13/providers/depsdev"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"deps.dev Go package metadata","desc":"Go module's pinned version, the full version history with publication dates and licenses, the latest published version and its timestamp, and the link to the upstream source project. Useful for stale-dependency, lagging-patch, and license audits. Select a package by its module path, for example depsdev.package(name: \"github.com/rs/zerolog\").","min_provider_version":"13.0.1","defaults":"name currentVersion latestVersion latestPublished","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"depsdev.packageVersion":{"id":"depsdev.packageVersion","name":"depsdev.packageVersion","fields":{"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the default version","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"licenses":{"name":"licenses","type":"\u0019\u0007","title":"SPDX license identifiers","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"links":{"name":"links","type":"\u001a\u0007\u0007","title":"Source and metadata links","desc":"Map from a link label to its URL. Labels include SOURCE_REPO, ISSUE_TRACKER, and ORIGIN.","min_provider_version":"13.0.20","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"publishedAt":{"name":"publishedAt","type":"\t","is_mandatory":true,"title":"Publication timestamp","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"registries":{"name":"registries","type":"\u0019\u0007","title":"Package registries where this version is published","min_provider_version":"13.0.20","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"relatedProjects":{"name":"relatedProjects","type":"\u0019\u001bdepsdev.relatedProject","title":"Projects related to this version (e.g. source repository, issue tracker)","min_provider_version":"13.0.20","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"slsaProvenances":{"name":"slsaProvenances","type":"\u0019\n","title":"SLSA build provenance attestations","desc":"Each entry records the sourceRepository, commit, url, and verified flag of a build provenance attestation recorded for this version.","min_provider_version":"13.0.20","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version string","provider":"go.mondoo.com/mql/v13/providers/depsdev"}},"title":"deps.dev package version","desc":"Single published release of a package, carrying its version string, publication timestamp, declared SPDX licenses, the registries it was published to, and any SLSA build provenance attestations. Compare publishedAt across a package's version history for lagging-patch and stale-dependency audits, and check whether a release ships verified build provenance.","private":true,"min_provider_version":"13.0.1","defaults":"version publishedAt","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"depsdev.project":{"id":"depsdev.project","name":"depsdev.project","fields":{"archived":{"name":"archived","type":"\u0004","title":"Whether the project repository is archived","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"description":{"name":"description","type":"\u0007","title":"Project description","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"forksCount":{"name":"forksCount","type":"\u0005","title":"Number of forks","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"homepage":{"name":"homepage","type":"\u0007","title":"Project homepage URL","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Project identifier (e.g. github.com/rs/zerolog)","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"license":{"name":"license","type":"\u0007","title":"SPDX license identifier","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"openIssuesCount":{"name":"openIssuesCount","type":"\u0005","title":"Number of open issues","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"scorecard":{"name":"scorecard","type":"\u001bdepsdev.scorecard","title":"OpenSSF Scorecard data","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"starsCount":{"name":"starsCount","type":"\u0005","title":"Number of stars","provider":"go.mondoo.com/mql/v13/providers/depsdev"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"deps.dev upstream source project (GitHub / GitLab repository)","desc":"Upstream source repository that deps.dev associates with a package: its description, homepage, SPDX license, archived state, and social-proof signals (stars, forks, open-issue count), along with the OpenSSF Scorecard results. Feeds supply-chain risk policies that flag unmaintained or archived dependencies and low-scorecard libraries. Select a project by its repository identifier, for example depsdev.project(id: \"github.com/rs/zerolog\").","min_provider_version":"13.0.1","defaults":"id starsCount forksCount","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"depsdev.relatedProject":{"id":"depsdev.relatedProject","name":"depsdev.relatedProject","fields":{"project":{"name":"project","type":"\u001bdepsdev.project","title":"Related source project","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"relationProvenance":{"name":"relationProvenance","type":"\u0007","is_mandatory":true,"title":"How the relationship was determined (e.g. GO_ORIGIN, SLSA_PROVENANCE)","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"relationType":{"name":"relationType","type":"\u0007","is_mandatory":true,"title":"Relationship type (e.g. SOURCE_REPO, ISSUE_TRACKER, ORIGIN)","provider":"go.mondoo.com/mql/v13/providers/depsdev"}},"title":"deps.dev package version related project","desc":"Link from a package version to a project that deps.dev associates with it, such as its source repository, issue tracker, or origin. The relationType records what kind of link it is and relationProvenance records how deps.dev determined it, so supply-chain policies can confirm a package points at the source repository it claims. The project resolves to the upstream project record with its OpenSSF Scorecard and repository signals.","private":true,"min_provider_version":"13.0.20","defaults":"relationType","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"depsdev.scorecard":{"id":"depsdev.scorecard","name":"depsdev.scorecard","fields":{"checks":{"name":"checks","type":"\u0019\u001bdepsdev.scorecardCheck","title":"Individual scorecard checks","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"date":{"name":"date","type":"\t","is_mandatory":true,"title":"Date of the scorecard evaluation","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"overallScore":{"name":"overallScore","type":"\u0006","is_mandatory":true,"title":"Overall scorecard score (0-10)","provider":"go.mondoo.com/mql/v13/providers/depsdev"}},"title":"OpenSSF Scorecard data from deps.dev","desc":"Automated supply-chain security assessment that OpenSSF Scorecard runs against a project's source repository, surfaced through deps.dev. The overallScore aggregates the individual checks (each listed in checks) that probe practices such as branch protection, code review, dependency pinning, signed releases, and continuous integration testing, producing a single 0-10 rating you can gate dependency adoption on. Inspect date to confirm how recent the evaluation is before relying on the score.","private":true,"min_provider_version":"13.0.1","defaults":"overallScore date","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"depsdev.scorecardCheck":{"id":"depsdev.scorecardCheck","name":"depsdev.scorecardCheck","fields":{"documentation":{"name":"documentation","type":"\u0007","is_mandatory":true,"title":"Link to check documentation","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Check name (e.g. Maintained, Code-Review)","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"reason":{"name":"reason","type":"\u0007","is_mandatory":true,"title":"Reason for the score","provider":"go.mondoo.com/mql/v13/providers/depsdev"},"score":{"name":"score","type":"\u0005","is_mandatory":true,"title":"Check score","desc":"Score for this individual check, from 0 to 10, or -1 when the check was inconclusive and could not be evaluated.","provider":"go.mondoo.com/mql/v13/providers/depsdev"}},"title":"OpenSSF Scorecard individual check","desc":"A single automated OpenSSF Scorecard check evaluating one supply-chain security practice of the project, such as branch protection, code review, or dependency pinning. Selected within a scorecard by the check name, for example name == \"Code-Review\" or name == \"Maintained\". The score and reason record how the project fared against that specific check.","private":true,"min_provider_version":"13.0.1","defaults":"name score reason","provider":"go.mondoo.com/mql/v13/providers/depsdev"}}}