Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
48 commits sit in this repo's top risk tercile, which is 33% of the 145scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 5.0 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Consistently other-driven across its history.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Risk | Top driver |
|---|---|---|---|---|---|---|
| 1 | dd8f10bfRudimentaty structure | Morten Primdahl | 14y ago | +2.3K -2 | 100%Elevated | large diff (many lines added) |
| 2 | 2563d532Validates the SAML response documents against an XSD before accepting. Checks for elements with duplicate ids during verification. | Morten Primdahl | 14y ago | +2.7K -113 | 99%Elevated | large diff (many lines added) |
| 3 | 67f7b4c1fix signature wrapping vulnerability | zendesk-mradmacher | 6mo ago | +330 -33 | 98%Elevated | large diff (many lines added) |
| 4 | 68a5fbefLint Ruby with StandardRb, enforced on CI | Benjamin Quorning | 6mo ago | +397 -404 | 97%Elevated | large diff (many lines added) |
| 5 | 8beccdfdUse all local schemas | Morten Primdahl | 14y ago | +439 -18 | 97%Elevated | large diff (many lines added) |
| 6 | b902d80dadd support for SHA256 fingerprints | Christopher Kintner | 10y ago | +216 -45 | 96%Elevated | large diff (many lines added) |
| 7 | 76f24ae0Schema validation for metadata | Morten Primdahl | 14y ago | +356 -7 | 96%Elevated | large diff (many lines added) |
| 8 | f1366b7bfixed PR issues, added functionality thats needed in zendesk_auth | Amir Hajimirsadeghi | 9y ago | +193 -27 | 94%Elevated | large diff (many lines added) |
| 9 | 564dd73fAdding license | Morten Primdahl | 13y ago | +184 -1 | 94%Elevated | large diff (many lines added) |
| 10 | 7769a749Handle x-path injection | Dan Robertson | 3mo ago | +142 -2 | 93%Elevated | large diff (many lines added) |
| 11 | 84d2d6a4added support for SAMLLogoutResponse | Amir Hajimirsadeghi | 9y ago | +145 -2 | 93%Elevated | large diff (many lines added) |
| 12 | e04d87e7The great rename | Morten Primdahl | 14y ago | +137 -176 | 92%Elevated | large diff (many lines added) |
| 13 | f4ecf1ecAdd audience verification to assertion/condition verify | Steven Davidovitz | 12y ago | +99 -14 | 91%Elevated | large diff (many lines added) |
| 14 | 0f60d87cintial LogoutRequest support | Steven Davidovitz | 12y ago | +101 -0 | 91%Elevated | large diff (many lines added) |
| 15 | a78568d1Command line tools | Morten Primdahl | 14y ago | +130 -43 | 90%Elevated | large diff (many lines added) |
| 16 | 6d91ba8cAdding support for responses without embedded certificate info | Brian Sanders | 13y ago | +84 -27 | 89%Elevated | large diff (many lines added) |
| 17 | c4301e93Unconfuse Time | Morten Primdahl | 14y ago | +104 -98 | 89%Elevated | large diff (many lines added) |
| 18 | 642ee89fFingerprint as a separate class | Morten Primdahl | 14y ago | +88 -47 | 88%Elevated | large diff (many lines added) |
| 19 | e1689971support multiple audience conditions | Christopher Kintner | 10y ago | +74 -8 | 87%Elevated | large diff (many lines added) |
| 20 | 8a36be69Improve time logic | Morten Primdahl | 14y ago | +77 -50 | 87%Elevated | large diff (many lines added) |
| 21 | 9b50bc49refractored data parsing, fixed pr issues | Amir Hajimirsadeghi | 9y ago | +72 -91 | 86%Elevated | large diff (many lines added) |
| 22 | 1108d804handle XSW case | Steven Davidovitz | 12y ago | +51 -31 | 86%Elevated | large diff (many lines added) |
| 23 | 93a2b845Support for logout options | Ana Martinez | 12y ago | +57 -7 | 84%Elevated | large diff (many lines added) |
| 24 | aff953f2backporting samlr vuln fix from zendesk_auth | Swati Krishnan | 7y ago | +67 -0 | 84%Elevated | large diff (many lines added) |
| 25 | 419668daMetadata. Various fixes. | Morten Primdahl | 14y ago | +79 -6 | 83%Elevated | large diff (many lines added) |
| 26 | 2c0e5a07Release v2.7.0 | Nony Dutton | 3y ago | +58 -12 | 82%Elevated | large diff (many lines added) |
| 27 | bcc066d1Put schema validation in logging mode | Morten Primdahl | 14y ago | +61 -9 | 82%Elevated | large diff (many lines added) |
| 28 | 950566f8refractored and fixed issues from new parse implementation | Amir Hajimirsadeghi | 9y ago | +55 -40 | 81%Elevated | large diff (many lines added) |
| 29 | b4e99333Surface Response#name_id and Response#attributes | Morten Primdahl | 14y ago | +59 -3 | 81%Elevated | large diff (many lines added) |
| 30 | d4bcac09Docs | Morten Primdahl | 14y ago | +49 -7 | 79%Elevated | large diff (many lines added) |
| 31 | dc78e43bMore informative conditions validation | Morten Primdahl | 14y ago | +43 -24 | 79%Elevated | large diff (many lines added) |
| 32 | 6279a1cbSurface attributes and name_id on assertion | Morten Primdahl | 14y ago | +47 -3 | 79%Elevated | large diff (many lines added) |
| 33 | b1af9e7fSwitch to trusted publishing workflow and run it on version.rb changes | github-actions | 1y ago | +35 -8 | 78%Elevated | large diff (many lines added) |
| 34 | 1b180cb6basic cli tests | Michael Grosser | 10y ago | +32 -0 | 77%Elevated | large diff (many lines added) |
| 35 | 2daaaf43Command line features | Morten Primdahl | 14y ago | +47 -13 | 77%Elevated | large diff (many lines added) |
| 36 | fa727803handle responses when one signature does not have a certificate | Christopher Kintner | 11y ago | +33 -11 | 75%Elevated | large diff (many lines added) |
| 37 | 8e86671drefactor | Steven Davidovitz | 12y ago | +36 -20 | 75%Elevated | large diff (many lines added) |
| 38 | b0bb6f13Missing assertion now raises Samlr::FormatError | Morten Primdahl | 14y ago | +42 -27 | 75%Elevated | large diff (many lines added) |
| 39 | d8ba3da9Failing test case for XSW attack | Udayakumar Rayala | 12y ago | +25 -0 | 73%Elevated | large diff (many lines added) |
| 40 | 9b94e34dRequest builder options | Ana Martinez | 12y ago | +26 -11 | 73%Elevated | large diff (many lines added) |
| 41 | c3b42f47adding test for xml comment attack | Swati Krishnan | 8y ago | +22 -0 | 72%Elevated | large diff (many lines added) |
| 42 | d01436c4[Product Security] Adding CodeQL Workflow | github-actions | 9mo ago | +19 -0 | 71%Elevated | large diff (many lines added) |
| 43 | dfcba07fremove trollop and unintuitive / random option shorthands | Michael Grosser | 10y ago | +26 -18 | 71%Elevated | large diff (many lines added) |
| 44 | 33a8359fConvenience method Request#url | Morten Primdahl | 14y ago | +28 -4 | 70%Elevated | large diff (many lines added) |
| 45 | 65ff507bError message improvements | Morten Primdahl | 14y ago | +23 -11 | 69%Elevated | large diff (many lines added) |
| 46 | 8ad20e80New License. Better error handling. | Morten Primdahl | 13y ago | +23 -21 | 68%Elevated | large diff (many lines added) |
| 47 | a5876622Support multiple attribute values | Morten Primdahl | 13y ago | +20 -6 | 68%Elevated | large diff (many lines added) |
| 48 | a8917e6cRequire test_helper in tests | Morten Primdahl | 13y ago | +14 -0 | 68%Elevated | scattered, high-entropy change |
| 49 | a4987181Schema validation no longer requires xmllint | Morten Primdahl | 14y ago | +25 -22 | 66%Typical | large diff (many lines added) |
| 50 | d412a770Better error messages, tests | Morten Primdahl | 14y ago | +23 -6 | 66%Typical | large diff (many lines added) |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 145 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
Repowise tracks change history across 49 files in zendesk/samlr. In the last 90 days 3 files were touched, 3 times in total, most often signature.rb. Every commit is scored for change risk from its size, spread and the history of the files it touches.
