Demonstrate Bomly Guard dependency protection

[bomly-guy]

Summary

• demonstrates Bomly Guard on a realistic dependency change
• uses demo-base as a guarded baseline with fail-on: any
• uses demo-head as a focused dependency-change branch for the Guard workflow to evaluate

Validation

• base branch contains .github/workflows/bomly-guard.yml
• base branch uses fail-on: any
• sourceclear/veracode references were removed from both branches
• PR diff includes dependency manifest or lockfile changes

[github-actions]

Bomly Diff Summary

Compared 09994c37b9209d85a38d138088ee92c3d180b69a to 31d5bfd46b3543d7be920014ebbd0daa4bdeb0f2.

Overview

Status	Manifests	Dependencies	Findings	Duration
❌ Failing findings	+0 / ~1 / -0	+0 / ~2 / -0	0 introduced / 2 persisted / 0 resolved	42.3s

Dependency Changes

Summary: 0 added, 2 changed, 0 removed.

Changed Dependencies

Change	Package	Version	Direct?	Scope	Licenses
changed	minimist	0.0.8 → 0.0.10	No	runtime	MIT
changed	minimist	1.2.5 → 1.2.8	Yes	runtime	MIT

Vulnerabilities

Summary: 0 introduced, 2 persisted, 1 resolved.

Persisted Vulnerabilities

Change	Severity	ID	Package	Fixed In	Source	Title
persisted	CRITICAL	GHSA-xvch-5gv4-984h	minimist@0.0.10	0.2.4	grype	Prototype Pollution in minimist
persisted	MEDIUM	GHSA-vh95-rmgr-6w4m	minimist@0.0.10	0.2.1	grype	Prototype Pollution in minimist

Resolved Vulnerabilities

Change	Severity	ID	Package	Fixed In	Source	Title
resolved	CRITICAL	GHSA-xvch-5gv4-984h	minimist@1.2.5	1.2.6	grype	Prototype Pollution in minimist

License Changes

✅ No license changes.

Project Posture

ℹ️ Scorecard ran, but no project posture data was found for these dependencies (e.g. no source repository is known).

Policy Findings

Summary: 0 introduced, 2 persisted, 0 resolved.

Persisted Findings

	Status	Category	Severity	ID	Package	Fixed In	Title
❌	persisted	vulnerability	CRITICAL	GHSA-xvch-5gv4-984h	minimist@0.0.10	0.2.4	Prototype Pollution in minimist
❌	persisted	vulnerability	MEDIUM	GHSA-vh95-rmgr-6w4m	minimist@0.0.10	0.2.1	Prototype Pollution in minimist

Legend: ✅ resolved · ❌ failing · ⚠️ warning