Advisories
When a rescan or a valid abuse report surfaces a new high-severity finding on a published version, the registry quarantines that version and raises an advisory against it. This is every advisory published against a public QuickAgent, newest first.
Nothing has been published to this feed yet.
When the registry raises an advisory it appears here, and on the affected QuickAgent's page.
How you find out
- A QuickAgent's own page carries its advisories beside its security report. Check there before you install or upgrade.
- Organizations can subscribe to
advisory.publishedandagent.quarantinedby webhook, and route them wherever they already watch for supply-chain events. GET /api/v1/advisoriesis this feed, keyset-paged;?affecting=namespace/namenarrows it to one QuickAgent.
What we cannot do
We cannot reach into an installation. A quarantined version stops resolving for new installs and is refused on direct download until a reviewer decides (a yanked one still downloads, with a warning header), but a copy already on your disk stays there. That is why advisories and webhooks exist, and why pinning versions in a lockfile you review is worth the trouble.