release 0.3.0

[ctolon]

Promotes dev to main. Gates decide; this description does not.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 2 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 12 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

Cargo.lock

Name	Version	Vulnerability	Severity
time	0.3.45	time vulnerable to stack exhaustion Denial of Service attack	moderate
aws-sdk-s3	1.96.0	AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value	low

License Issues

Cargo.lock

Package	Version	License	Issue Type
dynamic-config	0.7.0	Null	Unknown License
dynamic-config-consul	0.7.0	Null	Unknown License
dynamic-config-etcd	0.7.0	Null	Unknown License
dynamic-config-firestore	0.7.0	Null	Unknown License
dynamic-config-git	0.7.0	Null	Unknown License
dynamic-config-macros	0.7.0	Null	Unknown License
dynamic-config-nats	0.7.0	Null	Unknown License
dynamic-config-redis	0.7.0	Null	Unknown License
dynamic-config-s3	0.7.0	Null	Unknown License
dynamic-config-store-core	0.7.0	Null	Unknown License
dynamic-config-vault	0.7.0	Null	Unknown License

dynamic-config-python-remote/pyproject.toml

Package	Version	License	Issue Type
dynamic-config-py	>= 0.3.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
cargo/time	0.3.45	🟢 4.6	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST ⚠️ 0 no SAST tool detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected
cargo/aws-sdk-s3	1.96.0	Unknown	Unknown
cargo/dynamic-config	0.7.0	Unknown	Unknown
cargo/dynamic-config-consul	0.7.0	Unknown	Unknown
cargo/dynamic-config-etcd	0.7.0	Unknown	Unknown
cargo/dynamic-config-firestore	0.7.0	Unknown	Unknown
cargo/dynamic-config-git	0.7.0	Unknown	Unknown
cargo/dynamic-config-macros	0.7.0	Unknown	Unknown
cargo/dynamic-config-nats	0.7.0	Unknown	Unknown
cargo/dynamic-config-redis	0.7.0	Unknown	Unknown
cargo/dynamic-config-s3	0.7.0	Unknown	Unknown
cargo/dynamic-config-store-core	0.7.0	Unknown	Unknown
cargo/dynamic-config-vault	0.7.0	Unknown	Unknown
cargo/h2	0.4.16	🟢 6.5	Details Check Score Reason Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review 🟢 7 Found 22/29 approved changesets -- score normalized to 7 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 18 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/num-conv	0.1.0	🟢 3.6	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 0/8 approved changesets -- score normalized to 0 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected SAST ⚠️ 0 no SAST tool detected Maintained ⚠️ 1 2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
cargo/quinn-proto	0.11.17	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/redis	1.6.0	Unknown	Unknown
cargo/time-core	0.1.7	🟢 4.6	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST ⚠️ 0 no SAST tool detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected
cargo/time-macros	0.2.25	🟢 4.6	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST ⚠️ 0 no SAST tool detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected
cargo/zerovec-derive	0.11.5	🟢 6.4	Details Check Score Reason Binary-Artifacts 🟢 9 binaries present in source code Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 9 Found 27/30 approved changesets -- score normalized to 9 Contributors 🟢 10 project has 43 contributing companies or organizations Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing 🟢 10 project is fuzzed License 🟢 9 license file detected Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Vulnerabilities ⚠️ 0 23 existing vulnerabilities detected
pip/dynamic-config-py	>= 0.3.0	Unknown	Unknown

Scanned Files

• Cargo.lock
• dynamic-config-python-remote/pyproject.toml