[Musiker15]

Header und Footer haben das volle logo.png geladen (678 × 671 px, 176 KB), obwohl es nur mit 32 bis 36 px angezeigt wird. Mit next/image kommt eine passend verkleinerte WebP-Datei, dazu ein srcset für 2x. Damit sind auch die beiden Warnungen @next/next/no-img-element aus dem Code-Scan von #31 erledigt. Im Header lädt das Logo mit loading="eager", weil es immer sichtbar ist.

Die Dependency Review hat gewarnt, dass deny-licenses wegfällt (actions/dependency-review-action#997). Statt der Sperrliste GPL-2.0, GPL-3.0 steht jetzt eine Positivliste drin: alles, was heute im Lockfile vorkommt, plus AGPL-3.0-or-later als eigene Lizenz des Projekts. Die alte Liste hätte zum Beispiel AGPL durchgelassen.

actions/checkout steht überall auf v7 (codeql.yml hatte noch v4), actions/setup-node auf v7. Die Änderungen dort betreffen uns nicht, wir nutzen weder pull_request_target noch registry-url.

Geprüft: tsc und eslint lokal sauber, alle Workflows parsen als YAML.

Mirror to Codeberg läuft nur noch bei Pushes auf main und bei Tags. Der Trigger delete hat für jeden Branch, den ein gemergter PR oder Dependabot gelöscht hat, einen eigenen Lauf gestartet. Aufgeräumt wird auf Codeberg trotzdem, der nächste Push auf main entfernt den Branch dort mit --prune.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/eslint.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License
actions/setup-node	7.*.*	Null	Unknown License

.github/workflows/secret-scanning.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

Allowed Licenses:

MIT, ISC, 0BSD, BSD-2-Clause, BSD-3-Clause, Apache-2.0, BlueOak-1.0.0, CC0-1.0, CC-BY-4.0, OFL-1.1, MPL-2.0, LGPL-3.0-or-later, AGPL-3.0-or-later

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/setup-node	7.*.*	🟢 6.4	Details Check Score Reason Maintained 🟢 10 16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 9 binaries present in source code Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits
actions/actions/checkout	7.*.*	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/eslint.yml
• .github/workflows/secret-scanning.yml