Issues

• OSV format and GCVE extensions

  ossf/osv-schema#614 · Filter by author adulau opened on Sep 20, 2026

• Can the new severity source enum support databases other than NVD & SELF?

  ossf/osv-schema#581 · Filter by author mbauman opened on Jul 15, 2026
  2

• Proposal: ecosystem for AI agent "skills" (MCP / agent skill registries)

  ossf/osv-schema#568 · Filter by author eeee2345 opened on Jun 21, 2026
  7

• Add machine-readable "unmaintained" status to schema

  ossf/osv-schema#562 · Filter by author another-rex opened on Jun 15, 2026
  1

• Tighten guidelines on acceptable IDs

  ossf/osv-schema#547 · Filter by author jess-lowe opened on May 7, 2026

• Suggestion: addition of a metadata field for normative, linter-validated subfields

  ossf/osv-schema#518 · Filter by author conorfitch opened on Feb 23, 2026

• Suggestion: addition of a symbols field

  discussionenhancement
  ossf/osv-schema#501 · Filter by author jess-lowe opened on Jan 23, 2026
  1

• Optionally have overall CVSS score in severity

  ossf/osv-schema#495 · Filter by author djc opened on Jan 19, 2026
  1

• Create SAST check and require status check pass before changes can be merged

  security baseline
  ossf/osv-schema#492 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Document threshold for remediation of SAST finding

  security baseline
  ossf/osv-schema#491 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Enable SCA and require status check pass before changes can be merged

  security baseline
  ossf/osv-schema#490 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3
  1

• Document policy to address SCA violations prior to release

  security baseline
  ossf/osv-schema#489 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Define SCA finding threshold for remediation

  security baseline
  ossf/osv-schema#488 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Create policy for publishing VEX documents

  security baseline
  ossf/osv-schema#487 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Perform threat modeling

  security baseline
  ossf/osv-schema#486 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Create policy for adding or updating tests

  security baseline
  ossf/osv-schema#485 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Document when and how tests are run

  security baseline
  ossf/osv-schema#484 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Document when releases or versions will no longer receive security updates

  security baseline
  ossf/osv-schema#483 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Document scope and duration of support for each release

  security baseline
  ossf/osv-schema#482 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Release must include instructions for release author identity verification

  security baseline
  ossf/osv-schema#481 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3
  1

• Define a policy for managing secrets and credentials used by the project

  security baseline
  ossf/osv-schema#480 · Filter by author taladrane opened on Jan 14, 2026 · Security Baseline Level 3

• Clarify the usage of "limit" and "fixed" in GIT ranges.

  ossf/osv-schema#468 · Filter by author calebbrown opened on Dec 5, 2025

• Incorrect 'fixed' version for some Red Hat packages

  ossf/osv-schema#422 · Filter by author jasinner opened on Sep 18, 2025
  2

  

• Create a dependencies policy

  security baseline
  ossf/osv-schema#369 · Filter by author jasinner opened on Jul 24, 2025 · Security Baseline Level 3
  2

  

• Review users with admin role to osv-schema project

  security baseline
  ossf/osv-schema#368 · Filter by author jasinner opened on Jul 24, 2025 · Security Baseline Level 3