tighten / checkmate Goto Github PK

I have projects on 4.* and 5.* that are being marked as "current"

If possible. (within each section)

E.g. if an app is on Laravel 5.4 and that's not maintained anymore.

This may require us to occasionally update a stored-in-code table matching each version with its security expiration date.

It can be like Ozzie does: a grid of all of the behind ones, each with their status as the color and the icon, and the version, and a link to their github.

I think I'd delete the ": 2.6"
Lower left hand (where "PRs: 7 (5 old") is would be "current version"
Lower right hand (where "Issues: 9 (7 old)") is would be "Prescribed version"

See the Ozzie codebase for how to do this :)
https://github.com/tighten/ozzie/blob/main/app/Console/Commands/SendStatsToSlack.php
https://github.com/tighten/ozzie/blob/main/app/OrgSlack.php
https://github.com/tighten/ozzie/blob/main/app/Notifications/SendOzzieStats.php

There should be a view where you can show all projects with a specific dependency below a certain version.

Example: show all projects with an installed (composer.lock) version of symfony/http-foundation below v2.7.50

Right now we have two statuses: "Behind" and "Current". It'd be nice for them to be grouped by status.

This would control whether notifications were sent for the package, or if its even show in the table.

First auth (maybe only) will require someone to be in a certain Google organization.

So, for example, Tighten's .env will have something like GOOGLE_ORG=tighten.co and then anyone with a tighten.co email address can oauth into the app. No one else can get in.

If a project is insecure, this is a higher priority concern than just "not up to the latest minor version".

Main thinking about "insecure" would be "on version of Laravel that isn't getting security updates" (#23)

https://twitter.com/official_php/status/1080150686904582146

Primary goal would be to know whether we've updated PHP to the latest, etc.