--version replaces the commit hash on the cover and the project page, for
generate and from-folder alike. Without it the report still falls back to
repository_version from the metadata, else the scanned commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dependency check is named CipherCell SCA throughout, and the sources
keep one order on the cover, in the summary, the most-critical table and
the sections. Lynkeus before SAST no longer depends on the run order in
the SARIF file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The project page takes the size from cloc's sum and names the three to
five largest languages, leaving out prose and data files such as Markdown,
text, CSV and JSON, and anything under 1% of the code beyond the third.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report now covers every finding from all tools, so "SAST/SCA Report"
undersold it. The report and artifact ids were never filled in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alexanderandClaude Opus 5.5