## What's Changed ## General * :sparkles: Added CLI flags to scan multiple repositories `--repos`, or an entire GitHub organization `--org` (#4793, @gabrielsoltz) ## Checks ### Branch-Protection * :bug: Fix branch-protection scoring so GitHub rulesets without include patterns are honored, eliminating false warnings for branches covered by those rulesets. (#4835, @trask) ### Codeowners * :bug: add a codeowner expansion limit to prevent api exhaustion by @spencerschrock in https://github.com/ossf/scorecard/pull/4817 ### Pinned-Dependencies * :bug: add check for empty github workflow `uses` by @spencerschrock in https://github.com/ossf/scorecard/pull/4832 ### Vulnerabilities * :bug: Updated osv-scanner to v2.2.4 for Vulnerabilities detection. (#4833, @spencerschrock) ## Docs * :book: fix dependencies typo by @martincostello in https://github.com/ossf/scorecard/pull/4809 ## Other * :seedling: MAINTAINERS: Add Adam Korczynski (AdamKorcz), ADA Logics by @justaugustus in https://github.com/ossf/scorecard/pull/4808 * :seedling: cron add repositories: key Qwen, Meta-Llama, and OSS GPT repositories by @mkdolan in https://github.com/ossf/scorecard/pull/4811 * :seedling: cron: repair GitHub project list with excess path components by @spencerschrock in https://github.com/ossf/scorecard/pull/4819 * :seedling: Added additional AI project repos. by @mkdolan in https://github.com/ossf/scorecard/pull/4838 ## New Contributors * @mkdolan made their first contribution in https://github.com/ossf/scorecard/pull/4811 * @gabrielsoltz made their first contribution in https://github.com/ossf/scorecard/pull/4793 **Full Changelog**: https://github.com/ossf/scorecard/compare/v5.3.0...v5.4.0

## What's Changed ## General * :bug: Scorecard now skips dangling symlinks and detects symlink path traversal when run on local files. Note: Scorecard has always skipped all symlinks when run against a remote repository. (#4785, @spencerschrock) * :sparkles: The `scorecard serve` command was refactored and fixed. It accepts HTTP requests, analyzes the repo, and returns the result over HTTP. by @Fix3dP0int in https://github.com/ossf/scorecard/pull/4665 ``` scorecard serve # will start serving on localhost:8080 curl http://localhost:8080?repo=github.com/ossf/scorecard&show_details=true {"date":"2025-09-30T09:08:38-06:00","repo":{"name":"github.com/ossf/scorecard","commit":"c22063e786c11f9dd714d777a687ff7c4599b600"},"scorecard":{"version":"devel","commit":"unknown"},"score":9.5 # rest omitted ``` ## Checks ### Branch-Protection * :bug: Prevent ListReleases from failing a run for forges which don't support the operation (#4677, @JamieMagee) * :bug: Skip tag-only rulesets during Branch-Protection by @trask in https://github.com/ossf/scorecard/pull/4699 ### Contributors * :bug: Fixed a nil pointer dereference in the Contributors check for GitHub repos analyzed with `--file-mode=git` (#4705, @spencerschrock) ### Dangerous-Workflow * :sparkles: Scorecard detects dangerous use of discussion title and body. (#4719, @AdamKorcz) * :sparkles: Scorecard detects dangerous use of `blocked_user.name` and `blocked_user.email` (#4720, @AdamKorcz) ### Fuzzing * :sparkles: feat(jsx): support fuzzing in jsx files #4663 by @dsm23 in https://github.com/ossf/scorecard/pull/4664 ### Packaging * :bug: remove setup-go requirement for Packaging with goreleaser by @AdamKorcz in https://github.com/ossf/scorecard/pull/4673 * :sparkles: Support Elixir packaging workflows (#4684, @AdamKorcz) ### Pinned-Dependencies * :bug: Check for unpinned reusable workflow calls. (#4681, @AdamKorcz) * :bug: Support git URLs for calls to npm install. (#4680, @AdamKorcz) * :bug: Fixed a bug where URLs with surrounding quotes weren't being parsed (#4736, @Fix3dP0int) * :bug: Fixed a bug when looking up digests for unpinned docker image remediations. (#4683, @AdamKorcz) * :bug: Docker args are now evaluated when determining if container images are pinned. (#4780, @spencerschrock) * :bug: Files downloaded from a pinned GitHub reference are now marked as pinned even when downloaded across multiple commands by @spencerschrock in https://github.com/ossf/scorecard/pull/4777 ### SAST * :bug: Fixed a bug where SAST probes would dereference a nil pointer(#4675, @AdamKorcz) * :sparkles: add support for hadolint SAST by @AdamKorcz in https://github.com/ossf/scorecard/pull/4688 ### Signed-Releases * :bug: Signed-Releases now detects signatures ending with `.sigstore.json` (#4728, @mark-adams) ### Security-Policy * :sparkles: Start recognizing escaped emails in security policy documents (#4676, @ralphbean) ### Token-Permissions * :sparkles: Add `zizmorcore/zizmor-action` to allow-list for use of `security-events: write`. (#4758, @martincostello) ## Docs * :book: Capitalization and punctuation in CONTRIBUTING.md by @dcaine125 in https://github.com/ossf/scorecard/pull/4714 * :book: Docs improvements for package manager flags in README.md file by @jakbrownbytes in https://github.com/ossf/scorecard/pull/4732 * :book: document missing cron checks in README by @spencerschrock in https://github.com/ossf/scorecard/pull/4707 * :book: Rephrased the CI-Test description. by @kailealee in https://github.com/ossf/scorecard/pull/4708 * :book: Separated command and output in README by @devon3583 in https://github.com/ossf/scorecard/pull/4731 * :book: spelling fixes by @scop in https://github.com/ossf/scorecard/pull/4750 * :book: add error clarification for github branch protection errors by @spencerschrock in https://github.com/ossf/scorecard/pull/4778 * :book: Fix typo in TODO comment by @deivid-rodriguez in https://github.com/ossf/scorecard/pull/4801 ## Other * :seedling: move from golang/mock to uber/gomock by @tylerauerbeck in https://github.com/ossf/scorecard/pull/4645 * :seedling: chore: add apache-maven by @Ndacyayisenga-droid in https://github.com/ossf/scorecard/pull/4666 * :seedling: Add unit tests to cover collectPolicyHits by @ralphbean in https://github.com/ossf/scorecard/pull/4674 * :seedling: security: pin GitHub Actions to commit hashes by @harekrishnarai in https://github.com/ossf/scorecard/pull/4678 * :seedling: limit webhook payload size to 1024 bytes by @spencerschrock in https://github.com/ossf/scorecard/pull/4700 * :seedling: add test cases for author name and email by @AdamKorcz in https://github.com/ossf/scorecard/pull/4721 * :seedling: avoid unnecessary `[]byte` to `string` conversions by @spencerschrock in https://github.com/ossf/scorecard/pull/4539 * :seedling: cron: repair gitlab project list by @spencerschrock in https://github.com/ossf/scorecard/pull/4658 * :seedling: add awslabs/mcp project to public data feed by @scottschreckengaust in https://github.com/ossf/scorecard/pull/4739 * :seedling: cron: treat orgs with IP allowlist as inaccessible by @spencerschrock in https://github.com/ossf/scorecard/pull/4747 * :seedling: chore: Add Hiero's hiero-did-sdk-js and hiero-hederium by @jwagantall in https://github.com/ossf/scorecard/pull/4743 * :bug: delete broken slsa-goreleaser workflow by @martincostello in https://github.com/ossf/scorecard/pull/4776 * :seedling: migrate to golangci-lint v2 by @spencerschrock in https://github.com/ossf/scorecard/pull/4641 * :seedling: Adds new Chromium dependencies to cron scan config. by @renewitt in https://github.com/ossf/scorecard/pull/4794 * :seedling: migrate tablewriter dependency to v1 new API by @spencerschrock in https://github.com/ossf/scorecard/pull/4796 ## New Contributors * @tylerauerbeck made their first contribution in https://github.com/ossf/scorecard/pull/4645 * @dsm23 made their first contribution in https://github.com/ossf/scorecard/pull/4664 * @Ndacyayisenga-droid made their first contribution in https://github.com/ossf/scorecard/pull/4666 * @ralphbean made their first contribution in https://github.com/ossf/scorecard/pull/4674 * @harekrishnarai made their first contribution in https://github.com/ossf/scorecard/pull/4678 * @trask made their first contribution in https://github.com/ossf/scorecard/pull/4699 * @dcaine125 made their first contribution in https://github.com/ossf/scorecard/pull/4714 * @mark-adams made their first contribution in https://github.com/ossf/scorecard/pull/4728 * @jakbrownbytes made their first contribution in https://github.com/ossf/scorecard/pull/4732 * @kailealee made their first contribution in https://github.com/ossf/scorecard/pull/4708 * @scottschreckengaust made their first contribution in https://github.com/ossf/scorecard/pull/4739 * @devon3583 made their first contribution in https://github.com/ossf/scorecard/pull/4731 * @scop made their first contribution in https://github.com/ossf/scorecard/pull/4750 * @jwagantall made their first contribution in https://github.com/ossf/scorecard/pull/4743 * @Fix3dP0int made their first contribution in https://github.com/ossf/scorecard/pull/4665 * @deivid-rodriguez made their first contribution in https://github.com/ossf/scorecard/pull/4801 **Full Changelog**: https://github.com/ossf/scorecard/compare/v5.2.1...v5.3.0

## What's Changed ## General * :sparkles: Scorecard can now generate its output as an in-toto statement by specifying --format=intoto (#4491, @puerco) * :sparkles: Improved the performance of `--file-mode git` (#4563, @spencerschrock) * :bug: Ensure artifactLocation in sarif output are escaped by @xhochy in https://github.com/ossf/scorecard/pull/4619 * :sparkles: Scorecard now supports configuration files ending in either `.yml` or `.yaml` (#4568, @ratancs) * :seedling: Go 1.23.0 is now required to build Scorecard or use it as a library. (#4547, @spencerschrock) ## Checks ### CI-Tests * :bug: Fixed detection for Cirrus CI (#4564, @spencerschrock) ### Contributors * :sparkles: Users listed in CODEOWNERS file in GitHub repos now contribute to Contributors check (#4611, @lharrison13) ### SAST * :bug: SAST: Fixed an issue with Sonar Cloud not being detected due to a renamed GitHub app. (#4541, @spencerschrock) ## Probes * :sparkles: Added independent probe that checks for ecosystem specific non-memory safety practices in the codebase and flags them. (#4499, @balteravishay) ## Documentation * :book: Fix grammar in maintained check messages. (#4618, @martincostello) * :book: Fix GitHub Actions badges in README.md by @PeterDaveHello in https://github.com/ossf/scorecard/pull/4592 * :book: MAINTAINERS: Reflect active project contributors and affiliations by @justaugustus in https://github.com/ossf/scorecard/pull/4521 ## New Contributors * @puerco made their first contribution in https://github.com/ossf/scorecard/pull/4491 * @ratancs made their first contribution in https://github.com/ossf/scorecard/pull/4568 * @PeterDaveHello made their first contribution in https://github.com/ossf/scorecard/pull/4592 * @rscohn2 made their first contribution in https://github.com/ossf/scorecard/pull/4596 * @llindsaya made their first contribution in https://github.com/ossf/scorecard/pull/4605 * @xhochy made their first contribution in https://github.com/ossf/scorecard/pull/4619 * @ryjones made their first contribution in https://github.com/ossf/scorecard/pull/4628 **Full Changelog**: https://github.com/ossf/scorecard/compare/v5.1.1...v5.2.0

## What's Changed * Fixed a data race when analyzing repositories with `--file-mode git` (#4522, @spencerschrock) **Full Changelog**: https://github.com/ossf/scorecard/compare/v5.1.0...v5.1.1

# What's Changed We’ll highlight the major changes between `v4.13.1` and `v5.0.0` below, as well as some of the changes between `v5.0.0-rc2` and `v5.0.0`. For a more complete picture, see the [v5.0.0-rc1](https://github.com/ossf/scorecard/releases/tag/v5.0.0-rc1) and [v5.0.0-rc2](https://github.com/ossf/scorecard/releases/tag/v5.0.0-rc2) changelogs as well. ## Structured Results Structured Results is the main feature from this release. At a high level, structured results involve breaking the existing 19 Scorecard Checks into individual heuristics so users can pick and choose which ones they care about. You can see a list of all supported probes by checking out our [documentation](https://github.com/ossf/scorecard/blob/main/docs/probes.md) (paying attention to [lifecycle / stability guarantees](https://github.com/ossf/scorecard/blob/main/probes/README.md#lifecycle)). To run individual probes, use the `--probes` CLI flag with a comma separated list of names. You must also specify the `--format probe` option to see the results. Please run `scorecard --help` if you need more details. Example: ```shell scorecard --repo github.com/ossf/scorecard --probes archived,fuzzed,hasLicenseFile --format probe ``` For more details on the feature, please check out our [blog post](https://openssf.org/blog/2024/04/17/beyond-scores-with-openssf-scorecard-granular-structured-results-for-custom-policy-enforcement/) or the talk given at Open Source Summit NA 2024: [Structured Scorecard Results: Tailor Your Own Supply-Chain Security Policies](https://www.youtube.com/watch?v=ZT3XdMF6U5A). ## Maintainer Annotations Maintainer Annotations let maintainers add context to display alongside Scorecard check results. Annotations can provide users additional information when Scorecard has an incomplete assessment of a project's security practices. To see the maintainers annotations for each check, if present, use the `--show-annotations` option. For example, the `not-detected` annotation can annotate when a maintainer fulfills a check or probe in a way that is supported by Scorecard but not identified. For more details, check out our [documentation](https://github.com/ossf/scorecard/blob/main/config/README.md) for the feature. ## Breaking Changes ### API changes The biggest change is that everything in [github.com/ossf/scorecard/v4/pkg](https://pkg.go.dev/github.com/ossf/scorecard/v4/pkg) now lives in [github.com/ossf/scorecard/v5/pkg/scorecard](https://pkg.go.dev/github.com/ossf/scorecard/v5/pkg/scorecard). This allows renaming of some function names and types to be less repetitive. * `RunScorecard` is now `Run` * `ScorecardResult` is now `Result` Expected changes: ``` pkg.ScorecardRun() -> scorecard.Run() pkg.ScorecardResult -> scorecard.Result ``` The signature of `RunScorecard` (now called `Run`) has changed to allow for fewer breaking changes in the future. For full motivation, see the [associated issue](https://github.com/ossf/scorecard/issues/3717). There should be fewer setup code needed than before. Callers no longer need to pass in all clients and arguments and can rely on sensible default behavior. Callers that want to customize the analysis can influence the results with our Option types. A [similar change](https://github.com/ossf/scorecard/pull/4151) was done with formatting the results, which now accept an option struct pointer. Using a nil pointer will use default values. ### Unlikely to cause issues These changes are technically breaking in a semver sense, but we don’t expect most users to depend on them or require changes. * Dependency diff functionality has been removed in #4146. * For GitHub replacements, consider [actions/dependency-review-action](https://github.com/actions/dependency-review-action) which now supports showing Scorecard data. * `clients.Repo` must now implement Path in #4104 * `clients.RepoClient` now returns a read closer in #3912 * Some branch protection types were renamed in #3879 * Some sentinel errors were renamed in #4040 ## Checks ### Binary-Artifacts * Binary-Artifacts check now supports the new gradle wrapper validation action, and can be pinned to a hash. (#4097, @spencerschrock) ### Dependency-Update-Tool * :sparkles: Recognize scala-steward as dependency update tool by @raboof in https://github.com/ossf/scorecard/pull/4130 ### Fuzzing * :warning: OneFuzz detection removed due to deprecation https://github.com/ossf/scorecard/pull/3666 ### License * :bug: fix Unlicense detection by @spencerschrock in https://github.com/ossf/scorecard/pull/4145 * :book: Improve the REUSE parts of the License check by @mxmehl in https://github.com/ossf/scorecard/pull/4155 ### Packaging * :sparkles: detect `sbt ci-release` packaging workflows by @raboof in https://github.com/ossf/scorecard/pull/4135 ### Pinned-Dependencies * Improve Pinned-Dependencies remediation creation performance (#4131, @raboof) * :sparkles: Add support for Nuget restore by @balteravishay in https://github.com/ossf/scorecard/pull/4157 ### SBOM * :sparkles: Add experimental check for published SBOM by @ashearin in https://github.com/ossf/scorecard/pull/3903 ### Vulnerabilities * :seedling: add stack info to osv-scanner error by @Zxilly in https://github.com/ossf/scorecard/pull/4172 ## Probes * :sparkles: probe: releases with verified provenance by @raghavkaul in https://github.com/ossf/scorecard/pull/4141 ## Other * :bug: Use direct endpoint instead of search to find repository URL from npm database by @aklevans in https://github.com/ossf/scorecard/pull/4118 * :sparkles: move to cgr base image by @naveensrinivasan in https://github.com/ossf/scorecard/pull/4113 * :bug: fix: correct sarif json schema url by @Zxilly in https://github.com/ossf/scorecard/pull/4170 ## New Contributors * @petermetz made their first contribution in https://github.com/ossf/scorecard/pull/4111 * @aklevans made their first contribution in https://github.com/ossf/scorecard/pull/4118 * @mxmehl made their first contribution in https://github.com/ossf/scorecard/pull/4155 * @Zxilly made their first contribution in https://github.com/ossf/scorecard/pull/4170 **Full Changelog**: https://github.com/ossf/scorecard/compare/v4.13.1...v5.0.0

> [!IMPORTANT] > This is a v5 prerelease candidate. There may be more breaking changes before the official v5.0.0 release. ## What's Changed ### Structured Results * :sparkles: allow probes to collect their own data from repo clients by @spencerschrock in https://github.com/ossf/scorecard/pull/4052 ### Check Enhancements and Bug Fixes * Signed-Releases * :bug: Fixed a Signed-Releases bug where more releases were being analyzed than intended. (#4060, @spencerschrock) * Code-Review * :bug: Fixed an issue where Phabricator reviews weren't being parsed properly. (#4086, @spencerschrock) ### Breaking Changes * :warning: errors in ErrXXX format by @cmwylie19 in https://github.com/ossf/scorecard/pull/4040 * :warning: Enables maintainers to write annotations for Scorecard checks and consumers to view these annotations in Scorecard UI. (**experimental** #3905, @gabibguti) ### Docs * :book: Docs: update website by @raghavkaul in https://github.com/ossf/scorecard/pull/4041 * :book: governance: Adopt Scorecard project charter by @justaugustus in https://github.com/ossf/scorecard/pull/4054 ### Other * :seedling: Remove survey by @afmarcum in https://github.com/ossf/scorecard/pull/4077 * :seedling: Update Binary-Artifacts and License tests by @seelder in https://github.com/ossf/scorecard/pull/4079 ## New Contributors * @cmwylie19 made their first contribution in https://github.com/ossf/scorecard/pull/4040 * @seelder made their first contribution in https://github.com/ossf/scorecard/pull/4079 **Full Changelog**: https://github.com/ossf/scorecard/compare/v5.0.0-rc1...v5.0.0-rc2

> [!IMPORTANT] > This is a v5 prerelease candidate. There may be more breaking changes before the official v5.0.0 release. ## What's Changed ### Structured Results We invite users to try out a preview of Structured Results, the main feature from this release candidate. For more details on the feature, please check out the first paragraph of our [probes README](https://github.com/ossf/scorecard/blob/main/probes/README.md) as well as our blog post (coming next week). At a high level, structured results involves breaking the existing 19 Scorecard Checks into individual heuristics so users can pick and choose which ones they care about. You can see a list of all supported probes by checking out the `probes/` directory. To run individual probes, use the `--probes` CLI flag with a comma separated list of names. You must also specify the `--format probe` option to see the results. Please run `scorecard --help` if you need more details. Example: ```shell scorecard --repo github.com/ossf/scorecard --probes archived,fuzzed,hasLicenseFile --format probe ``` ### Check Enhancements and Bug Fixes * Branch-Protection * :sparkles: Branch Protection check now also evaluates if the project requires PRs prior to make changes to the branch. This won't change anything for the users that already require reviews, but will enable score enhancement for those who can't require reviewers. (#3499, @diogoteles08) * Dependency-Update-Tool * :sparkles: Dependency-Update-Tool now detects Renovate config files in a `.gitlab` folder. (#3823, @spencerschrock) * :bug: Sonatype Lift is no longer recognized as a Dependency-Update-Tool because it is retired. (#3605, @spencerschrock) * :bug: Dependency-Update-Tool: ignore search commit data for repo clients which dont support it by @spencerschrock in https://github.com/ossf/scorecard/pull/3756 * Fuzzing * :warning: Remove OneFuzz from fuzzing checks by @DavidKorczynski in https://github.com/ossf/scorecard/pull/3666 * Pinned-Dependencies * :bug: Pinned-Dependencies now continues after encountering runtime errors (#3515, @pnacht) * :bug: Scorecard no longer considers unpinned Dockerfiles in `vendor` and `third_party` directories. (#3675, @AdamKorcz) * :bug: Files downloaded by Git SHA from GitHub and executed are no longer considered as not pinned by hash. (#3694, @martincostello) * :bug: Shell commands in Dockerfile here-documents are now parsed correctly by the Pinned-Dependencies check (#3774, @jkreileder) * Signed-Releases * :bug: Fixed a bug which allowed some repos to score higher than 10 in the Signed-Releases check. (#3768, @spencerschrock) * :sparkles: Support `.sigstore` bundles to check for signed releases (#3772, @edgarrmondragon) * Vulnerabilities * :bug: Projects without dependencies or packages no longer throw an error for the Vulnerabilities check. (#3803, @spencerschrock) * :bug: Go stdlib vulns are removed Vulnerabilities check output (#3925, @spencerschrock) #### RepoClient Improvements * GitHub * :bug: Scorecard processes commit activity from large GitHub repos in chunks to avoid timeout issues (#3680, @spencerschrock) * GitLab * :bug: Fix scanning for GitLab private repositories. (#3596, @gabibguti) * :sparkles: Added `--commit-depth` support for GitLab repos (#3672, @ashearin) * :bug: Parse Gitlab Status fields to align w/Github Status and Conclusion by @ashearin in https://github.com/ossf/scorecard/pull/3706 * :bug: Fix signed release error for empty gitlab repo by @naveensrinivasan in https://github.com/ossf/scorecard/pull/3753 * :bug: Scorecard no longer crashes on GitLab repos with no commits (#3731, @ashearin) * :bug: Fixed a bug which prevented Scorecard from analyzing some self-hosted GitLab repos. (#3819, @spencerschrock) * Local Directory * :bug: ignore .git folder for localdir by @naveensrinivasan in https://github.com/ossf/scorecard/pull/3943 #### Other * :bug: Fix nils by @naveensrinivasan in https://github.com/ossf/scorecard/pull/3750 * :sparkles: Added logic to ensure check scores are between 0 and 10 (#3769, @spencerschrock) ### Breaking Changes * File access through RepoClient now returns an io.ReadCloser, instead of the full file contents. (#3912, @spencerschrock). This enabled fixing two bugs which affect very large repos. * :bug: Limit Binary Artifact file reads to first 1024 bytes by @spencerschrock in https://github.com/ossf/scorecard/pull/3923 * :bug: Avoid reading every file searching for sonar configs by @spencerschrock in https://github.com/ossf/scorecard/pull/3929 * :warning: refactor: rename fields on Branch Protection Pull Request rules by @diogoteles08 in https://github.com/ossf/scorecard/pull/3879 * :warning: remove`rule.Remediation` and switch users to `probe.Remediation` by @spencerschrock in https://github.com/ossf/scorecard/pull/3978 ### Docs * :book: fix typo by @AdamKorcz in https://github.com/ossf/scorecard/pull/3699 * :book: Added beginner's guide to scorecard checks docs by @ariathaker in https://github.com/ossf/scorecard/pull/3617 * :book: fixup transposition typos in remediation package copy by @daveworth in https://github.com/ossf/scorecard/pull/3734 * :book: Update README with zoom meeting info by @leec94 in https://github.com/ossf/scorecard/pull/3739 * :book: Clarify lack of 2FA check in README by @raghavkaul in https://github.com/ossf/scorecard/pull/3784 * :book: Add documentation about probes and contributing by @AdamKorcz in https://github.com/ossf/scorecard/pull/3762 * :book: Spelling by @jsoref in https://github.com/ossf/scorecard/pull/3804 * :book: Update contributor ladder to reduce duration requirements by @afmarcum in https://github.com/ossf/scorecard/pull/3899 * :book: Update slack image by @afmarcum in https://github.com/ossf/scorecard/pull/3906 * :book: Document that `.sigstore` bundles are part of check for Signed-Releases (#3922, @cpswan) * :book: Add survey announcement to readme by @afmarcum in https://github.com/ossf/scorecard/pull/3942 * :book: Review and update CONTRIBUTING.md by @spencerschrock in https://github.com/ossf/scorecard/pull/4002 * :book: revert PAT scope change and document Go resources by @spencerschrock in https://github.com/ossf/scorecard/pull/4003 ## New Contributors * @ashearin made their first contribution in https://github.com/ossf/scorecard/pull/3672 * @ariathaker made their first contribution in https://github.com/ossf/scorecard/pull/3617 * @daveworth made their first contribution in https://github.com/ossf/scorecard/pull/3734 * @edgarrmondragon made their first contribution in https://github.com/ossf/scorecard/pull/3772 * @manishtiwari25 made their first contribution in https://github.com/ossf/scorecard/pull/3732 * @jkreileder made their first contribution in https://github.com/ossf/scorecard/pull/3774 * @tuminoid made their first contribution in https://github.com/ossf/scorecard/pull/3783 * @lelia made their first contribution in https://github.com/ossf/scorecard/pull/3822 * @jsoref made their first contribution in https://github.com/ossf/scorecard/pull/3804 * @jitsengupta17 made their first contribution in https://github.com/ossf/scorecard/pull/3302 * @cpswan made their first contribution in https://github.com/ossf/scorecard/pull/3922 * @adamdmharvey made their first contribution in https://github.com/ossf/scorecard/pull/3972 * @fhoeborn made their first contribution in https://github.com/ossf/scorecard/pull/3838 **Full Changelog**: https://github.com/ossf/scorecard/compare/v4.13.1...v5.0.0-rc1

## What's Changed ### New * Fuzzing * :sparkles: Adds fuzzing probes for C, CPP, Python, Rust and Java by @DavidKorczynski in https://github.com/ossf/scorecard/pull/3473 * :sparkles: Add support for `fast-check` test runners integrations by @sheerlox in https://github.com/ossf/scorecard/pull/3568 * Weekly Public Data Cron * :seedling: Adding all Intel public GitHub repos by @ware in https://github.com/ossf/scorecard/pull/3556 ### Bug Fixes * SAST * :bug: Fix usage of GitHub CodeQL not being detected correctly by @martincostello in https://github.com/ossf/scorecard/pull/3591 ### Docs * :book: fix "default" typo by @testwill in https://github.com/ossf/scorecard/pull/3543 ## New Contributors * @testwill made their first contribution in https://github.com/ossf/scorecard/pull/3543 * @ware made their first contribution in https://github.com/ossf/scorecard/pull/3556 * @sheerlox made their first contribution in https://github.com/ossf/scorecard/pull/3568 **Full Changelog**: https://github.com/ossf/scorecard/compare/v4.13.0...v4.13.1