Demonstrate dependency diff

[bomly-guy]

Summary

• demonstrates Bomly Guard on a real dependency diff
• uses a base branch rebuilt from the current default branch, including the merged Bomly Guard workflow
• adds a single dependency-demo commit on the head branch so the guard workflow evaluates a focused dependency change

Validation

• verified the base branch contains .github/workflows/bomly-guard.yml
• verified the head branch is one commit ahead of the base branch
• verified the PR diff includes dependency manifest or lockfile changes

[github-actions]

Bomly Diff Summary

Compared c226b2c1f8bcbc40ab51d80febd28c044a96f818 to 244b61627df73ff2fbec6a1db882369808f29e88.

Overview

Status	Manifests	Dependencies	Findings	Duration
❌ Failing findings introduced	+0 / ~1 / -0	+0 / ~2 / -0	1 introduced / 0 persisted / 2 resolved	51712ms

Dependency Changes

Summary: 0 added, 2 changed, 0 removed.

Changed Dependencies

Change	Package	Version	Scope	Licenses	PURL
changed	minimist	0.0.8 → 0.0.10	runtime	MIT	pkg:npm/minimist@0.0.10
changed	minimist	1.2.5 → 1.2.8	runtime	MIT	pkg:npm/minimist@1.2.8

Vulnerabilities

Summary: 0 introduced, 1 resolved.

Resolved Vulnerabilities

	Change	Severity	ID	Package	Fixed In	Exploitability	Source	Title
✅	resolved	CRITICAL	GHSA-xvch-5gv4-984h	minimist@1.2.5	1.2.6	risk 4.3	grype	Prototype Pollution in minimist

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (or --matchers +scorecard was not selected).

Policy Findings

Summary: 1 introduced, 0 persisted, 2 resolved.

Introduced Findings

	Status	Category	Severity	Disposition	ID	Package	Fixed In	Exploitability	Title
❌	introduced	vulnerability	CRITICAL	fail	GHSA-xvch-5gv4-984h	minimist@0.0.10	0.2.4	risk 4.3	Prototype Pollution in minimist

Resolved Findings

	Status	Category	Severity	Disposition	ID	Package	Fixed In	Exploitability	Title
✅	resolved	vulnerability	CRITICAL	fail	GHSA-xvch-5gv4-984h	minimist@0.0.8	0.2.4	risk 4.3	Prototype Pollution in minimist
✅	resolved	vulnerability	CRITICAL	fail	GHSA-xvch-5gv4-984h	minimist@1.2.5	1.2.6	risk 4.3	Prototype Pollution in minimist

[bomly-guy]

Closing in favor of the same Bomly Guard demo using simpler branch names: demo-head into demo-base.