{
  "history": [
    {
      "added": 0,
      "commit": "01886c8a910c64595c47f186ca1ffc0b77fa5458",
      "date": "2026-11-01",
      "dependencies": 46,
      "errors": [],
      "fixable": 42,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 40,
      "osv_only": 4,
      "ref": "v1.5.0",
      "release_changed": false,
      "release_integrity": "no-assets",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 3.5,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 2,
        "High": 16,
        "Low": 5,
        "Medium": 19,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 7,
        "Low": 0,
        "Medium": 4,
        "files": 2
      }
    },
    {
      "added": 0,
      "commit": "01886c8a910c64595c47f186ca1ffc0b77fa5458",
      "date": "2026-11-02",
      "dependencies": 46,
      "errors": [],
      "fixable": 42,
      "go_version": null,
      "in_binary": null,
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 40,
      "osv_only": 4,
      "ref": "v1.5.0",
      "release_changed": false,
      "release_integrity": "no-assets",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 3.5,
      "scorecard_date": "2026-10-26",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 2,
        "High": 16,
        "Low": 5,
        "Medium": 19,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 9,
      "workflow": {
        "High": 7,
        "Low": 0,
        "Medium": 4,
        "files": 2
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Pre-commit & Secrets Detection",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v1.5.0",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "01886c8a910c64595c47f186ca1ffc0b77fa5458",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v2",
        "version": "v2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/setup-python",
        "purl": "pkg:github/actions/setup-python@v2",
        "version": "v2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/pypi.yml",
        "name": "pypa/gh-action-pypi-publish",
        "purl": "pkg:github/pypa/gh-action-pypi-publish@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "attrs",
        "purl": "pkg:pypi/attrs@23.2.0",
        "version": "23.2.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "backports-entry-points-selectable",
        "purl": "pkg:pypi/backports-entry-points-selectable@1.3.0",
        "version": "1.3.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "certifi",
        "purl": "pkg:pypi/certifi@2023.11.17",
        "version": "2023.11.17"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "cfgv",
        "purl": "pkg:pypi/cfgv@3.4.0",
        "version": "3.4.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "charset-normalizer",
        "purl": "pkg:pypi/charset-normalizer@3.3.2",
        "version": "3.3.2"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "coverage",
        "purl": "pkg:pypi/coverage@7.5.1",
        "version": "7.5.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "distlib",
        "purl": "pkg:pypi/distlib@0.3.8",
        "version": "0.3.8"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "filelock",
        "purl": "pkg:pypi/filelock@3.13.1",
        "version": "3.13.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev-minimal.txt",
        "name": "flake8",
        "purl": "pkg:pypi/flake8@7.0.0",
        "version": "7.0.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "gibberish-detector",
        "purl": "pkg:pypi/gibberish-detector@0.1.1",
        "version": "0.1.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "identify",
        "purl": "pkg:pypi/identify@2.5.36",
        "version": "2.5.36"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "idna",
        "purl": "pkg:pypi/idna@3.7",
        "version": "3.7"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "iniconfig",
        "purl": "pkg:pypi/iniconfig@2.0.0",
        "version": "2.0.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "mccabe",
        "purl": "pkg:pypi/mccabe@0.7.0",
        "version": "0.7.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "monotonic",
        "purl": "pkg:pypi/monotonic@1.6",
        "version": "1.6"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "mypy",
        "purl": "pkg:pypi/mypy@0.971",
        "version": "0.971"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "mypy-extensions",
        "purl": "pkg:pypi/mypy-extensions@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "nodeenv",
        "purl": "pkg:pypi/nodeenv@1.8.0",
        "version": "1.8.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "packaging",
        "purl": "pkg:pypi/packaging@24.0",
        "version": "24.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "platformdirs",
        "purl": "pkg:pypi/platformdirs@4.2.1",
        "version": "4.2.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pluggy",
        "purl": "pkg:pypi/pluggy@1.5.0",
        "version": "1.5.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pre-commit",
        "purl": "pkg:pypi/pre-commit@3.5.0",
        "version": "3.5.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "py",
        "purl": "pkg:pypi/py@1.11.0",
        "version": "1.11.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pyahocorasick",
        "purl": "pkg:pypi/pyahocorasick@2.1.0",
        "version": "2.1.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pycodestyle",
        "purl": "pkg:pypi/pycodestyle@2.11.1",
        "version": "2.11.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pyflakes",
        "purl": "pkg:pypi/pyflakes@3.2.0",
        "version": "3.2.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pyparsing",
        "purl": "pkg:pypi/pyparsing@3.1.2",
        "version": "3.1.2"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pytest",
        "purl": "pkg:pypi/pytest@7.4.3",
        "version": "7.4.3"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "pyyaml",
        "purl": "pkg:pypi/pyyaml@6.0.1",
        "version": "6.0.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "requests",
        "purl": "pkg:pypi/requests@2.31.0",
        "version": "2.31.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "responses",
        "purl": "pkg:pypi/responses@0.25.0",
        "version": "0.25.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "six",
        "purl": "pkg:pypi/six@1.16.0",
        "version": "1.16.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "toml",
        "purl": "pkg:pypi/toml@0.10.2",
        "version": "0.10.2"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "tox",
        "purl": "pkg:pypi/tox@4.15.0",
        "version": "4.15.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "tox-pip-extensions",
        "purl": "pkg:pypi/tox-pip-extensions@1.6.0",
        "version": "1.6.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "typed-ast",
        "purl": "pkg:pypi/typed-ast@1.5.5",
        "version": "1.5.5"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "types-pyyaml",
        "purl": "pkg:pypi/types-pyyaml@6.0.12.12",
        "version": "6.0.12.12"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "types-requests",
        "purl": "pkg:pypi/types-requests@2.31.0.20240106",
        "version": "2.31.0.20240106"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "typing-extensions",
        "purl": "pkg:pypi/typing-extensions@4.11.0",
        "version": "4.11.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "unidiff",
        "purl": "pkg:pypi/unidiff@0.7.5",
        "version": "0.7.5"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "urllib3",
        "purl": "pkg:pypi/urllib3@2.1.0",
        "version": "2.1.0"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "virtualenv",
        "purl": "pkg:pypi/virtualenv@20.26.1",
        "version": "20.26.1"
      },
      {
        "ecosystem": "pypi",
        "licenses": [],
        "location": "requirements-dev.txt",
        "name": "zipp",
        "purl": "pkg:pypi/zipp@3.18.1",
        "version": "3.18.1"
      }
    ],
    "description": "Prevent secrets from entering codebases",
    "errors": [],
    "id": "Yelp__detect-secrets",
    "manifests": [
      ".github/workflows/ci.yml",
      ".github/workflows/pypi.yml",
      "requirements-dev-minimal.txt",
      "requirements-dev.txt",
      "setup.cfg",
      "setup.py"
    ],
    "name": "detect-secrets",
    "osv": {
      "advisories": 44,
      "available": true,
      "confirmed": 40,
      "osv_only": [
        {
          "ecosystem": "PyPI",
          "ids": [
            "BIT-setuptools-2022-40897",
            "CVE-2022-40897",
            "GHSA-r9hx-vwmv-q579",
            "PYSEC-2022-43012"
          ],
          "package": "setuptools",
          "score": "8.7",
          "severity": "High",
          "version": "9.1.0"
        },
        {
          "ecosystem": "PyPI",
          "ids": [
            "BIT-setuptools-2025-47273",
            "CVE-2025-47273",
            "GHSA-5rjg-fvgr-3xxf",
            "PYSEC-2025-49"
          ],
          "package": "setuptools",
          "score": "8.8",
          "severity": "High",
          "version": "9.1.0"
        },
        {
          "ecosystem": "PyPI",
          "ids": [
            "BIT-setuptools-2024-6345",
            "CVE-2024-6345",
            "GHSA-cx63-2mw6-8hw5",
            "PYSEC-2026-1918"
          ],
          "package": "setuptools",
          "score": "8.8",
          "severity": "High",
          "version": "9.1.0"
        },
        {
          "ecosystem": "PyPI",
          "ids": [
            "BIT-setuptools-2026-59890",
            "CVE-2026-59890",
            "GHSA-h35f-9h28-mq5c",
            "PYSEC-2026-3447"
          ],
          "package": "setuptools",
          "score": "6.1",
          "severity": "Medium",
          "version": "9.1.0"
        }
      ],
      "warning": null
    },
    "ref": "v1.5.0",
    "ref_kind": "release",
    "release_integrity": {
      "assets": 0,
      "checksums_published": false,
      "methods": [],
      "provenance_published": false,
      "sbom_published": false,
      "signatures_published": false,
      "verdict": "no-assets"
    },
    "released_at": "2024-05-06T18:05:06Z",
    "repository": "Yelp/detect-secrets",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 53 shared packages \u2014 no actual upgrades",
        "Core system packages stable: pypi (44) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:09:45+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Branch-Protection",
          "reason": "branch protection not enabled on development/release branches",
          "score": 0
        },
        {
          "name": "CII-Best-Practices",
          "reason": "no effort to earn an OpenSSF best practices badge detected",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Maintained",
          "reason": "0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 0",
          "score": 0
        },
        {
          "name": "SAST",
          "reason": "SAST tool is not run on all commits -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file not detected",
          "score": 0
        },
        {
          "name": "Token-Permissions",
          "reason": "detected GitHub workflow tokens with excessive permissions",
          "score": 0
        },
        {
          "name": "Code-Review",
          "reason": "Found 6/8 approved changesets -- score normalized to 7",
          "score": 7
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow not detected",
          "score": -1
        },
        {
          "name": "Signed-Releases",
          "reason": "no releases found",
          "score": -1
        }
      ],
      "date": "2026-10-26",
      "score": 3.5,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [
      {
        "aliases": [],
        "ecosystem": "pypi",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "2026.10.18"
        ],
        "id": "GHSA-6q48-6c7w-9gw2",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "certifi",
        "severity": "Critical",
        "summary": "certifi bundles emSign root CAs with compromised intermediate CA keys",
        "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
        "version": "2023.11.17"
      },
      {
        "aliases": [],
        "ecosystem": "github",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.14.3"
        ],
        "id": "GHSA-5xjx-3w67-w9x9",
        "kev": null,
        "location": ".github/workflows/pypi.yml",
        "osv_confirmed": false,
        "package": "pypa/gh-action-pypi-publish",
        "severity": "Critical",
        "summary": "pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI",
        "url": "https://github.com/advisories/GHSA-5xjx-3w67-w9x9",
        "version": "v1.5.0"
      },
      {
        "aliases": [
          "CVE-2025-66471"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2025-66471",
          "percentile": 0.52471,
          "score": 0.00682
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.0"
        ],
        "id": "GHSA-2xpw-w6gg-jr37",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "High",
        "summary": "urllib3 streaming API improperly handles highly compressed data",
        "url": "https://github.com/advisories/GHSA-2xpw-w6gg-jr37",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2026-21441"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-21441",
          "percentile": 0.87044,
          "score": 0.02922
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.3"
        ],
        "id": "GHSA-38jv-5279-wg99",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "High",
        "summary": "Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",
        "url": "https://github.com/advisories/GHSA-38jv-5279-wg99",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2026-97687"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-97687",
          "percentile": 0.10658,
          "score": 0.00206
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.8.0"
        ],
        "id": "GHSA-8988-9cw3-xx77",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "High",
        "summary": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden",
        "url": "https://github.com/advisories/GHSA-8988-9cw3-xx77",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2025-66418"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2025-66418",
          "percentile": 0.52471,
          "score": 0.00682
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.0"
        ],
        "id": "GHSA-gm62-xv2j-4w53",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "High",
        "summary": "urllib3 allows an unbounded number of links in the decompression chain",
        "url": "https://github.com/advisories/GHSA-gm62-xv2j-4w53",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2026-44431"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-44431",
          "percentile": 0.26325,
          "score": 0.00331
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.7.0"
        ],
        "id": "GHSA-qccp-gfcp-xxvc",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "High",
        "summary": "urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",
        "url": "https://github.com/advisories/GHSA-qccp-gfcp-xxvc",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2026-97689"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-97689",
          "percentile": 0.26853,
          "score": 0.00335
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.8.0"
        ],
        "id": "GHSA-vxq7-64xx-v4gw",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "High",
        "summary": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory",
        "url": "https://github.com/advisories/GHSA-vxq7-64xx-v4gw",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2026-113718"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113718",
          "percentile": 0.15459,
          "score": 0.00242
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-394h-qwmc-48pf",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv: Xonsh activation literals depend on the script decoding codec",
        "url": "https://github.com/advisories/GHSA-394h-qwmc-48pf",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113726"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113726",
          "percentile": 0.28043,
          "score": 0.00345
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.4"
        ],
        "id": "GHSA-5vjq-rrrf-7h2q",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
        "url": "https://github.com/advisories/GHSA-5vjq-rrrf-7h2q",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113723"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113723",
          "percentile": 0.15459,
          "score": 0.00242
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-6w3r-xr62-4xcp",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv: Bash prompt values can change meaning under older compatibility modes",
        "url": "https://github.com/advisories/GHSA-6w3r-xr62-4xcp",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-102930"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-102930",
          "percentile": 0.09409,
          "score": 0.00197
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.7.12"
        ],
        "id": "GHSA-94p9-xgh2-xp45",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use",
        "url": "https://github.com/advisories/GHSA-94p9-xgh2-xp45",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113732"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113732",
          "percentile": 0.14706,
          "score": 0.00236
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.2"
        ],
        "id": "GHSA-c947-3pg5-gm8q",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote",
        "url": "https://github.com/advisories/GHSA-c947-3pg5-gm8q",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113722"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113722",
          "percentile": 0.21101,
          "score": 0.00285
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-c978-59m8-c77v",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax",
        "url": "https://github.com/advisories/GHSA-c978-59m8-c77v",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-102925"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-102925",
          "percentile": 0.04986,
          "score": 0.00159
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.7.13"
        ],
        "id": "GHSA-p58f-9548-mpm2",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
        "url": "https://github.com/advisories/GHSA-p58f-9548-mpm2",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2024-53899"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2024-53899",
          "percentile": 0.75405,
          "score": 0.01572
        },
        "fix_state": "fixed",
        "fixed_in": [
          "20.26.6"
        ],
        "id": "GHSA-rqc4-2hc7-8c8v",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv allows command injection through activation scripts for a virtual environment",
        "url": "https://github.com/advisories/GHSA-rqc4-2hc7-8c8v",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113725"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113725",
          "percentile": 0.1824,
          "score": 0.00263
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.7"
        ],
        "id": "GHSA-vxj4-q4g9-crj7",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv bash activate runs commands from an environment name with a backslash before $",
        "url": "https://github.com/advisories/GHSA-vxj4-q4g9-crj7",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-102937"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-102937",
          "percentile": 0.1092,
          "score": 0.00208
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.7.12"
        ],
        "id": "GHSA-x78j-v8h9-3j2q",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "High",
        "summary": "virtualenv: Command injection via --prompt in activate.bat (batch activator)",
        "url": "https://github.com/advisories/GHSA-x78j-v8h9-3j2q",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-112909"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-112909",
          "percentile": 0.12637,
          "score": 0.0022
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.2.1"
        ],
        "id": "GHSA-69hj-f68j-2879",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "filelock",
        "severity": "Medium",
        "summary": "filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",
        "url": "https://github.com/advisories/GHSA-69hj-f68j-2879",
        "version": "3.13.1"
      },
      {
        "aliases": [
          "CVE-2026-112910"
        ],
        "ecosystem": "pypi",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "4.2.1"
        ],
        "id": "GHSA-8mx5-7m5m-r77g",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "filelock",
        "severity": "Medium",
        "summary": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
        "url": "https://github.com/advisories/GHSA-8mx5-7m5m-r77g",
        "version": "3.13.1"
      },
      {
        "aliases": [
          "CVE-2026-22701"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-22701",
          "percentile": 0.0231,
          "score": 0.00127
        },
        "fix_state": "fixed",
        "fixed_in": [
          "3.20.3"
        ],
        "id": "GHSA-qmgc-5h2g-mvrw",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "filelock",
        "severity": "Medium",
        "summary": "filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",
        "url": "https://github.com/advisories/GHSA-qmgc-5h2g-mvrw",
        "version": "3.13.1"
      },
      {
        "aliases": [
          "CVE-2025-68146"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2025-68146",
          "percentile": 0.0954,
          "score": 0.00198
        },
        "fix_state": "fixed",
        "fixed_in": [
          "3.20.1"
        ],
        "id": "GHSA-w853-jp5j-5j7f",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "filelock",
        "severity": "Medium",
        "summary": "filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",
        "url": "https://github.com/advisories/GHSA-w853-jp5j-5j7f",
        "version": "3.13.1"
      },
      {
        "aliases": [
          "CVE-2026-45409"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-45409",
          "percentile": 0.35091,
          "score": 0.00408
        },
        "fix_state": "fixed",
        "fixed_in": [
          "3.15"
        ],
        "id": "GHSA-65pc-fj4g-8rjx",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "idna",
        "severity": "Medium",
        "summary": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",
        "url": "https://github.com/advisories/GHSA-65pc-fj4g-8rjx",
        "version": "3.7"
      },
      {
        "aliases": [
          "CVE-2025-71176"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2025-71176",
          "percentile": 0.0448,
          "score": 0.00154
        },
        "fix_state": "fixed",
        "fixed_in": [
          "9.0.3"
        ],
        "id": "GHSA-6w46-j5rx-g56g",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "pytest",
        "severity": "Medium",
        "summary": "pytest has vulnerable tmpdir handling",
        "url": "https://github.com/advisories/GHSA-6w46-j5rx-g56g",
        "version": "7.4.3"
      },
      {
        "aliases": [
          "CVE-2024-47081"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2024-47081",
          "percentile": 0.62224,
          "score": 0.0098
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.32.4"
        ],
        "id": "GHSA-9hjg-9r4m-mvj7",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "requests",
        "severity": "Medium",
        "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
        "url": "https://github.com/advisories/GHSA-9hjg-9r4m-mvj7",
        "version": "2.31.0"
      },
      {
        "aliases": [
          "CVE-2024-35195"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2024-35195",
          "percentile": 0.2751,
          "score": 0.0034
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.32.0"
        ],
        "id": "GHSA-9wx4-h78v-vm56",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "requests",
        "severity": "Medium",
        "summary": "Requests `Session` object does not verify requests after making first request with verify=False",
        "url": "https://github.com/advisories/GHSA-9wx4-h78v-vm56",
        "version": "2.31.0"
      },
      {
        "aliases": [
          "CVE-2026-25645"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-25645",
          "percentile": 0.08606,
          "score": 0.00189
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.33.0"
        ],
        "id": "GHSA-gc5v-m9x4-r6x2",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "requests",
        "severity": "Medium",
        "summary": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",
        "url": "https://github.com/advisories/GHSA-gc5v-m9x4-r6x2",
        "version": "2.31.0"
      },
      {
        "aliases": [
          "CVE-2024-37891"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2024-37891",
          "percentile": 0.6666,
          "score": 0.01141
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.2.2"
        ],
        "id": "GHSA-34jh-p97f-mpxf",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "Medium",
        "summary": "urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects",
        "url": "https://github.com/advisories/GHSA-34jh-p97f-mpxf",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2025-50181"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2025-50181",
          "percentile": 0.40987,
          "score": 0.00474
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.5.0"
        ],
        "id": "GHSA-pq67-6m6q-mj2v",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "urllib3",
        "severity": "Medium",
        "summary": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",
        "url": "https://github.com/advisories/GHSA-pq67-6m6q-mj2v",
        "version": "2.1.0"
      },
      {
        "aliases": [
          "CVE-2026-113724"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113724",
          "percentile": 0.10341,
          "score": 0.00203
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-43mp-35q3-x3fq",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv: Deletion recovery can change a symlink target's mode",
        "url": "https://github.com/advisories/GHSA-43mp-35q3-x3fq",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113721"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113721",
          "percentile": 0.03666,
          "score": 0.00144
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-558c-9hv2-4prj",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv: Generated files can follow existing destination links",
        "url": "https://github.com/advisories/GHSA-558c-9hv2-4prj",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-22702"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-22702",
          "percentile": 0.0086,
          "score": 0.001
        },
        "fix_state": "fixed",
        "fixed_in": [
          "20.36.1"
        ],
        "id": "GHSA-597g-3phw-6986",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv Has TOCTOU Vulnerabilities in Directory Creation",
        "url": "https://github.com/advisories/GHSA-597g-3phw-6986",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-102938"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-102938",
          "percentile": 0.03847,
          "score": 0.00146
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.7.11"
        ],
        "id": "GHSA-9h9j-4vrj-gf7g",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
        "url": "https://github.com/advisories/GHSA-9h9j-4vrj-gf7g",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113716"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113716",
          "percentile": 0.03665,
          "score": 0.00144
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-cw65-gx24-rc82",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv: Builtin creation follows linked environment directories",
        "url": "https://github.com/advisories/GHSA-cw65-gx24-rc82",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113720"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113720",
          "percentile": 0.02859,
          "score": 0.00134
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-fc2g-4w5p-6whm",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv: Seeded files retain permissions from an older cache",
        "url": "https://github.com/advisories/GHSA-fc2g-4w5p-6whm",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113719"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113719",
          "percentile": 0.10341,
          "score": 0.00203
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-hhxq-47xx-j5xx",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Medium",
        "summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
        "url": "https://github.com/advisories/GHSA-hhxq-47xx-j5xx",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2024-5569"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2024-5569",
          "percentile": 0.14612,
          "score": 0.00236
        },
        "fix_state": "fixed",
        "fixed_in": [
          "3.19.1"
        ],
        "id": "GHSA-jfmj-5v4g-7637",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "zipp",
        "severity": "Medium",
        "summary": "zipp Denial of Service vulnerability",
        "url": "https://github.com/advisories/GHSA-jfmj-5v4g-7637",
        "version": "3.18.1"
      },
      {
        "aliases": [
          "CVE-2024-39689"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2024-39689",
          "percentile": 0.64252,
          "score": 0.01049
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2024.7.4"
        ],
        "id": "GHSA-248v-346w-9cwc",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "certifi",
        "severity": "Low",
        "summary": "Certifi removes GLOBALTRUST root certificate",
        "url": "https://github.com/advisories/GHSA-248v-346w-9cwc",
        "version": "2023.11.17"
      },
      {
        "aliases": [],
        "ecosystem": "github",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.13.0"
        ],
        "id": "GHSA-vxmw-7h4f-hqxh",
        "kev": null,
        "location": ".github/workflows/pypi.yml",
        "osv_confirmed": false,
        "package": "pypa/gh-action-pypi-publish",
        "severity": "Low",
        "summary": "PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps",
        "url": "https://github.com/advisories/GHSA-vxmw-7h4f-hqxh",
        "version": "v1.5.0"
      },
      {
        "aliases": [
          "CVE-2026-113714"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113714",
          "percentile": 0.16325,
          "score": 0.00249
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-494p-63j8-28p3",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Low",
        "summary": "virtualenv: Downloaded wheel selection and caching precede verification",
        "url": "https://github.com/advisories/GHSA-494p-63j8-28p3",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113717"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113717",
          "percentile": 0.21916,
          "score": 0.00293
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-cx28-75q4-x26q",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Low",
        "summary": "virtualenv: Pip seeding with download omits wheel digest verification",
        "url": "https://github.com/advisories/GHSA-cx28-75q4-x26q",
        "version": "20.26.1"
      },
      {
        "aliases": [
          "CVE-2026-113715"
        ],
        "ecosystem": "pypi",
        "epss": {
          "cve": "CVE-2026-113715",
          "percentile": 0.15459,
          "score": 0.00242
        },
        "fix_state": "fixed",
        "fixed_in": [
          "21.14.9"
        ],
        "id": "GHSA-qmx5-4p3x-wvqf",
        "kev": null,
        "location": "requirements-dev.txt",
        "osv_confirmed": true,
        "package": "virtualenv",
        "severity": "Low",
        "summary": "virtualenv: Venv configuration readback can reinterpret path boundaries",
        "url": "https://github.com/advisories/GHSA-qmx5-4p3x-wvqf",
        "version": "20.26.1"
      }
    ],
    "workflow_audit": {
      "files": 2,
      "findings": [
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/ci.yml",
          "line": 22,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/ci.yml",
          "line": 23,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/pypi.yml",
          "line": 20,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/pypi.yml",
          "line": 21,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/pypi.yml",
          "line": 35,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/pypi.yml",
          "line": 36,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/pypi.yml",
          "line": 44,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/ci.yml",
          "line": 15,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/pypi.yml",
          "line": 4,
          "note": "default permissions used due to no permissions: block",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/pypi.yml",
          "line": 13,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/pypi.yml",
          "line": 30,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "prefer trusted publishing for authentication",
          "file": ".github/workflows/pypi.yml",
          "line": 44,
          "note": "this step",
          "rule": "use-trusted-publishing",
          "severity": "Informational",
          "url": "https://docs.zizmor.sh/audits/#use-trusted-publishing"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}