ZuriHac 2025 - project / collaboration ideas

[frasertweedale]

Gautier (@blackheaven) will attend ZuriHac (possibly a couple other SRT members, not confirmed).

This ticket is a bag-of-holding for specific projects or collaboration ideas for ZuriHac. Share/discuss your ideas below and we will make a list here in the issue description.

Good first issue / beginner friendly

• A simple refactor: "is version affected" functions: migrate to library #253
• Follow up on the OSV "canonical source / how to edit" ask - How should OSV.dev consumers of Haskell Security Advisory DB records provide feedback on them? #252
• Ecosystem library review, i.e. for particular security-related use cases, what libs are there. Can we do a list with commentary?

Intermediate

• Implement the namespaces proposal: Support for other namespaces #240
• Additional CVSS metrics (temporal) - CVSS3.1 isn't fully supported #226

For the brave

• Finish the CVSS 4.0 support - add CVSS 4.0 support #167
• GitHub bot to assist SRT (and contributors) with reviewing advisory PRs - pull request automation - ideation #57

Broader ecosystem efforts

• SBOM (@MangoIV started something, IIRC)
• Renovate (what is the status? write a guide? @ysangkok led the development)
• cabal-audit - what is the status? what work can be done?

[ysangkok]

I won't be at Zurihac, but the status on Renovate is that Cabal bounds with the style >=X.Y && <V.W are supported.
There are ideas for future work in a discussion thread:

• Manager for Haskell Cabal files renovatebot/renovate#31493 (comment)

I would be ready to pair a few on video for a few hours to give more context. For example, if anybody is interested in working on it or getting their project set up.