Repository navigation

fix(supply-chain): SC4 must not claim a vulnerability it did not verify (#318) - #319

Merged

keshprad merged 6 commits into

NVIDIA:mainfrom

Mark2Mac:fix/sc4-unresolved-version-severity

Aug 4, 2026

Commits on Jul 30, 2026
- fix(supply-chain): treat only == / <= as version pins in requirements.txt
  Mark2Mac
  committed
  b750a46
- fix(supply-chain): only exact pins resolve to a version, ranges do not
  Mark2Mac
  committed
  15788af
Commits on Aug 4, 2026
- fix(supply-chain): SC4 must not claim a vulnerability it did not verify
  
  Mark2Mac
  authored and
  keshprad
  committed
  4705eeb
- fix(supply-chain): preserve full PEP 440 pins
  keshprad
  committed
  2fcaec2
- fix(supply-chain): parse pip requirement options
  keshprad
  committed
  a60c2e5
- style: format supply chain tests
  keshprad
  committed
  cb53449