{ "history": [ { "added": 0, "commit": "4fe07d805dd2a4b64fed486e95136923f08648d0", "date": "2026-11-01", "dependencies": 215, "errors": [], "fixable": 71, "go_version": null, "in_binary": null, "new_vulnerabilities": 0, "osv_confirmed": 71, "osv_only": 0, "ref": "v1.183.0", "release_changed": false, "release_integrity": "no-assets", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 2, "High": 26, "Low": 13, "Medium": 31, "Negligible": 0, "Unknown": 0 }, "workflow": { "High": 8, "Low": 4, "Medium": 27, "files": 13 } }, { "added": 0, "commit": "4fe07d805dd2a4b64fed486e95136923f08648d0", "date": "2026-11-02", "dependencies": 215, "errors": [], "fixable": 71, "go_version": null, "in_binary": null, "kev": 1, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 71, "osv_only": 0, "ref": "v1.183.0", "release_changed": false, "release_integrity": "no-assets", "removed": 0, "resolved_vulnerabilities": 1, "scorecard": null, "scorecard_date": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 26, "Low": 13, "Medium": 31, "Negligible": 0, "Unknown": 0 }, "vulnerable_packages": 20, "workflow": { "High": 8, "Low": 4, "Medium": 27, "files": 13 } } ], "latest": { "archived": false, "category": "Static Application Security Testing (SAST) \u203a Multi-language", "changes": { "added": [], "any": true, "baseline": false, "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v1.183.0", "release_changed": false, "removed": [], "resolved_vulnerabilities": [ { "aliases": [], "ecosystem": "npm", "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-hhhw-6fm7-r8ff", "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": false, "package": "tree-sitter-r", "severity": "Critical", "url": "https://github.com/advisories/GHSA-hhhw-6fm7-r8ff", "version": "file:src/tree-sitter-r" } ], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "4fe07d805dd2a4b64fed486e95136923f08648d0", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/lint.yml", "name": "actions/cache", "purl": "pkg:github/actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "version": "55cc8345863c7cc4c66a329aec7e433d2d1c52a9" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/ocaml-tree-sitter-ci.yml", "name": "actions/cache/restore", "purl": "pkg:github/actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9#restore", "version": "55cc8345863c7cc4c66a329aec7e433d2d1c52a9" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/ocaml-tree-sitter-ci.yml", "name": "actions/cache/save", "purl": "pkg:github/actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9#save", "version": "55cc8345863c7cc4c66a329aec7e433d2d1c52a9" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-test-core-x86.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10", "version": "df4cb1c069e1874edd31b4311f1884172cec0e10" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/sync-with-PRO.yml", "name": "actions/create-github-app-token", "purl": "pkg:github/actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1", "version": "bcd2ba49218906704ab6c1aa796996da409d3eb1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/tests.yml", "name": "actions/download-artifact", "purl": "pkg:github/actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131", "version": "37930b1c2abaa49bbe596cd826c3c89aef350131" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/lint.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", "version": "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-test-core-x86.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", "version": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/lint.yml", "name": "astral-sh/setup-uv", "purl": "pkg:github/astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78", "version": "37802adc94f370d6bfd71619e3f0bf239e1f3b78" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-test-docker.yml", "name": "depot/build-push-action", "purl": "pkg:github/depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287", "version": "98e78adca7817480b8185f474a400b451d74e287" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-test-docker.yml", "name": "depot/setup-action", "purl": "pkg:github/depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461", "version": "15c09a5f77a0840ad4bce955686522a257853461" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-test-docker.yml", "name": "docker/metadata-action", "purl": "pkg:github/docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302", "version": "dc802804100637a589fabce1cb79ff13a1411302" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/tests.yml", "name": "EndBug/add-and-commit", "purl": "pkg:github/EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8", "version": "cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-checklist.yaml", "name": "marocchino/sticky-pull-request-comment", "purl": "pkg:github/marocchino/sticky-pull-request-comment@v3.0.5", "version": "v3.0.5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/test-e2e-semgrep-ci.yml", "name": "peter-evans/create-pull-request", "purl": "pkg:github/peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1", "version": "5f6978faf089d4d20b00c7766989d076bb2fc7f1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-test-core-x86.yml", "name": "semgrep/setup-ocaml", "purl": "pkg:github/semgrep/setup-ocaml@a739c5405d73c42ef15a9dc995efc0f87396cc36", "version": "a739c5405d73c42ef15a9dc995efc0f87396cc36" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "ansi-regex", "purl": "pkg:npm/ansi-regex@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "aproba", "purl": "pkg:npm/aproba@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "are-we-there-yet", "purl": "pkg:npm/are-we-there-yet@1.1.5", "version": "1.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "base64-js", "purl": "pkg:npm/base64-js@1.5.1", "version": "1.5.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "bl", "purl": "pkg:npm/bl@4.0.3", "version": "4.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "buffer", "purl": "pkg:npm/buffer@5.7.1", "version": "5.7.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "chownr", "purl": "pkg:npm/chownr@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "code-point-at", "purl": "pkg:npm/code-point-at@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "console-control-strings", "purl": "pkg:npm/console-control-strings@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "core-util-is", "purl": "pkg:npm/core-util-is@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "decompress-response", "purl": "pkg:npm/decompress-response@4.2.1", "version": "4.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "deep-extend", "purl": "pkg:npm/deep-extend@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "delegates", "purl": "pkg:npm/delegates@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "detect-libc", "purl": "pkg:npm/detect-libc@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "end-of-stream", "purl": "pkg:npm/end-of-stream@1.4.4", "version": "1.4.4" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "expand-template", "purl": "pkg:npm/expand-template@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "fs-constants", "purl": "pkg:npm/fs-constants@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "gauge", "purl": "pkg:npm/gauge@2.7.4", "version": "2.7.4" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "github-from-package", "purl": "pkg:npm/github-from-package@0.0.0", "version": "0.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "has-unicode", "purl": "pkg:npm/has-unicode@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "ieee754", "purl": "pkg:npm/ieee754@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "inherits", "purl": "pkg:npm/inherits@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "ini", "purl": "pkg:npm/ini@1.3.8", "version": "1.3.8" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "is-fullwidth-code-point", "purl": "pkg:npm/is-fullwidth-code-point@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "isarray", "purl": "pkg:npm/isarray@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "mimic-response", "purl": "pkg:npm/mimic-response@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "minimist", "purl": "pkg:npm/minimist@1.2.5", "version": "1.2.5" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "mkdirp-classic", "purl": "pkg:npm/mkdirp-classic@0.5.3", "version": "0.5.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "nan", "purl": "pkg:npm/nan@2.14.2", "version": "2.14.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "napi-build-utils", "purl": "pkg:npm/napi-build-utils@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "node-abi", "purl": "pkg:npm/node-abi@2.19.3", "version": "2.19.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "noop-logger", "purl": "pkg:npm/noop-logger@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "npmlog", "purl": "pkg:npm/npmlog@4.1.2", "version": "4.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "number-is-nan", "purl": "pkg:npm/number-is-nan@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "object-assign", "purl": "pkg:npm/object-assign@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "once", "purl": "pkg:npm/once@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "prebuild-install", "purl": "pkg:npm/prebuild-install@5.3.6", "version": "5.3.6" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "prebuild-install", "purl": "pkg:npm/prebuild-install@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "process-nextick-args", "purl": "pkg:npm/process-nextick-args@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "pump", "purl": "pkg:npm/pump@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "rc", "purl": "pkg:npm/rc@1.2.8", "version": "1.2.8" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "readable-stream", "purl": "pkg:npm/readable-stream@2.3.7", "version": "2.3.7" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "readable-stream", "purl": "pkg:npm/readable-stream@3.6.0", "version": "3.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "safe-buffer", "purl": "pkg:npm/safe-buffer@5.1.2", "version": "5.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "semver", "purl": "pkg:npm/semver@5.7.1", "version": "5.7.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "set-blocking", "purl": "pkg:npm/set-blocking@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "signal-exit", "purl": "pkg:npm/signal-exit@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "simple-concat", "purl": "pkg:npm/simple-concat@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "simple-get", "purl": "pkg:npm/simple-get@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "string-width", "purl": "pkg:npm/string-width@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "string_decoder", "purl": "pkg:npm/string_decoder@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "strip-ansi", "purl": "pkg:npm/strip-ansi@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "strip-json-comments", "purl": "pkg:npm/strip-json-comments@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tar-fs", "purl": "pkg:npm/tar-fs@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tar-stream", "purl": "pkg:npm/tar-stream@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter", "purl": "pkg:npm/tree-sitter@0.16.1", "version": "0.16.1" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-c-sharp", "purl": "pkg:npm/tree-sitter-c-sharp@file%3Asrc%2Ftree-sitter-c-sharp", "version": "file:src/tree-sitter-c-sharp" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-cli", "purl": "pkg:npm/tree-sitter-cli@0.16.9", "version": "0.16.9" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-javascript", "purl": "pkg:npm/tree-sitter-javascript@file%3Asrc%2Ftree-sitter-javascript", "version": "file:src/tree-sitter-javascript" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-kotlin", "purl": "pkg:npm/tree-sitter-kotlin@file%3Asrc%2Ftree-sitter-kotlin", "version": "file:src/tree-sitter-kotlin" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-lua", "purl": "pkg:npm/tree-sitter-lua@file%3Asrc%2Ftree-sitter-lua", "version": "file:src/tree-sitter-lua" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-r", "purl": "pkg:npm/tree-sitter-r@file%3Asrc%2Ftree-sitter-r", "version": "file:src/tree-sitter-r" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-ruby", "purl": "pkg:npm/tree-sitter-ruby@file%3Asrc%2Ftree-sitter-ruby", "version": "file:src/tree-sitter-ruby" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tree-sitter-typescript", "purl": "pkg:npm/tree-sitter-typescript@file%3Asrc%2Ftree-sitter-typescript", "version": "file:src/tree-sitter-typescript" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "tunnel-agent", "purl": "pkg:npm/tunnel-agent@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "util-deprecate", "purl": "pkg:npm/util-deprecate@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "which-pm-runs", "purl": "pkg:npm/which-pm-runs@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "wide-align", "purl": "pkg:npm/wide-align@1.1.3", "version": "1.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "name": "wrappy", "purl": "pkg:npm/wrappy@1.0.2", "version": "1.0.2" }, { "ecosystem": "opam", "licenses": [], "location": "dev/optional.opam", "name": "optional", "purl": "pkg:opam/optional", "version": "UNKNOWN" }, { "ecosystem": "opam", "licenses": [ "LGPL-2.1-only" ], "location": "libs/python-str-repr/python-str-repr.opam", "name": "python-str-repr", "purl": "pkg:opam/python-str-repr", "version": "UNKNOWN" }, { "ecosystem": "opam", "licenses": [], "location": "dev/required.opam", "name": "required", "purl": "pkg:opam/required", "version": "UNKNOWN" }, { "ecosystem": "opam", "licenses": [ "LGPL-2.1-only" ], "location": "semgrep.opam", "name": "semgrep", "purl": "pkg:opam/semgrep", "version": "UNKNOWN" }, { "ecosystem": "opam", "licenses": [ "LGPL-2.1-only WITH OCaml-LGPL-linking-exception" ], "location": "cli/src/semgrep/semgrep_interfaces/semgrep-interfaces.opam", "name": "semgrep-interfaces", "purl": "pkg:opam/semgrep-interfaces", "version": "UNKNOWN" }, { "ecosystem": "opam", "licenses": [ "LGPL-2.1-only WITH OCaml-LGPL-linking-exception" ], "location": "libs/ocaml-tree-sitter-semgrep/core/tree-sitter.opam", "name": "tree-sitter", "purl": "pkg:opam/tree-sitter", "version": "UNKNOWN" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "annotated-types", "purl": "pkg:pypi/annotated-types@0.7.0", "version": "0.7.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "anyio", "purl": "pkg:pypi/anyio@4.14.2", "version": "4.14.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "appdirs", "purl": "pkg:pypi/appdirs@1.4.4", "version": "1.4.4" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "attrs", "purl": "pkg:pypi/attrs@25.4.0", "version": "25.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "backports-asyncio-runner", "purl": "pkg:pypi/backports-asyncio-runner@1.2.0", "version": "1.2.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "boltons", "purl": "pkg:pypi/boltons@21.0.0", "version": "21.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "bracex", "purl": "pkg:pypi/bracex@2.6", "version": "2.6" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "bytecode", "purl": "pkg:pypi/bytecode@0.17.0", "version": "0.17.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "certifi", "purl": "pkg:pypi/certifi@2026.10.19", "version": "2026.10.19" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "cffi", "purl": "pkg:pypi/cffi@2.0.0", "version": "2.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "cfgv", "purl": "pkg:pypi/cfgv@3.5.0", "version": "3.5.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "charset-normalizer", "purl": "pkg:pypi/charset-normalizer@3.4.4", "version": "3.4.4" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "click", "purl": "pkg:pypi/click@8.1.8", "version": "8.1.8" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "click", "purl": "pkg:pypi/click@8.4.2", "version": "8.4.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "click-option-group", "purl": "pkg:pypi/click-option-group@0.5.9", "version": "0.5.9" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "colorama", "purl": "pkg:pypi/colorama@0.4.6", "version": "0.4.6" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "cryptography", "purl": "pkg:pypi/cryptography@46.0.3", "version": "46.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "ddtrace", "purl": "pkg:pypi/ddtrace@4.2.1", "version": "4.2.1" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "distlib", "purl": "pkg:pypi/distlib@0.4.3", "version": "0.4.3" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "docutils", "purl": "pkg:pypi/docutils@0.22.4", "version": "0.22.4" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "envier", "purl": "pkg:pypi/envier@0.6.1", "version": "0.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "exceptiongroup", "purl": "pkg:pypi/exceptiongroup@1.2.2", "version": "1.2.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "execnet", "purl": "pkg:pypi/execnet@2.1.2", "version": "2.1.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "face", "purl": "pkg:pypi/face@24.0.0", "version": "24.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "filelock", "purl": "pkg:pypi/filelock@4.0.6", "version": "4.0.6" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "freezegun", "purl": "pkg:pypi/freezegun@1.5.5", "version": "1.5.5" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "glom", "purl": "pkg:pypi/glom@25.12.0", "version": "25.12.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "googleapis-common-protos", "purl": "pkg:pypi/googleapis-common-protos@1.72.0", "version": "1.72.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "h11", "purl": "pkg:pypi/h11@0.16.0", "version": "0.16.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "httpcore", "purl": "pkg:pypi/httpcore@1.0.9", "version": "1.0.9" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "httpx", "purl": "pkg:pypi/httpx@0.28.1", "version": "0.28.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "httpx-sse", "purl": "pkg:pypi/httpx-sse@0.4.3", "version": "0.4.3" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "identify", "purl": "pkg:pypi/identify@2.6.20", "version": "2.6.20" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "idna", "purl": "pkg:pypi/idna@3.11", "version": "3.11" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "importlib-metadata", "purl": "pkg:pypi/importlib-metadata@8.7.1", "version": "8.7.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "importlib-resources", "purl": "pkg:pypi/importlib-resources@6.5.2", "version": "6.5.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "iniconfig", "purl": "pkg:pypi/iniconfig@2.3.0", "version": "2.3.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "jinja2", "purl": "pkg:pypi/jinja2@3.1.6", "version": "3.1.6" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "jsonschema", "purl": "pkg:pypi/jsonschema@4.25.1", "version": "4.25.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "jsonschema-specifications", "purl": "pkg:pypi/jsonschema-specifications@2025.9.1", "version": "2025.9.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "markdown-it-py", "purl": "pkg:pypi/markdown-it-py@4.0.0", "version": "4.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "markupsafe", "purl": "pkg:pypi/markupsafe@3.0.3", "version": "3.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "mcp", "purl": "pkg:pypi/mcp@1.29.0", "version": "1.29.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "mdurl", "purl": "pkg:pypi/mdurl@0.1.2", "version": "0.1.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "mypy", "purl": "pkg:pypi/mypy@0.931", "version": "0.931" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "mypy-extensions", "purl": "pkg:pypi/mypy-extensions@1.1.0", "version": "1.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "nh3", "purl": "pkg:pypi/nh3@0.3.2", "version": "0.3.2" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "nodeenv", "purl": "pkg:pypi/nodeenv@1.11.0", "version": "1.11.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-api", "purl": "pkg:pypi/opentelemetry-api@1.37.0", "version": "1.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-exporter-otlp-proto-common", "purl": "pkg:pypi/opentelemetry-exporter-otlp-proto-common@1.37.0", "version": "1.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-exporter-otlp-proto-http", "purl": "pkg:pypi/opentelemetry-exporter-otlp-proto-http@1.37.0", "version": "1.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-instrumentation", "purl": "pkg:pypi/opentelemetry-instrumentation@0.58b0", "version": "0.58b0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-instrumentation-requests", "purl": "pkg:pypi/opentelemetry-instrumentation-requests@0.58b0", "version": "0.58b0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-instrumentation-threading", "purl": "pkg:pypi/opentelemetry-instrumentation-threading@0.58b0", "version": "0.58b0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-proto", "purl": "pkg:pypi/opentelemetry-proto@1.37.0", "version": "1.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-sdk", "purl": "pkg:pypi/opentelemetry-sdk@1.37.0", "version": "1.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-semantic-conventions", "purl": "pkg:pypi/opentelemetry-semantic-conventions@0.58b0", "version": "0.58b0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "opentelemetry-util-http", "purl": "pkg:pypi/opentelemetry-util-http@0.58b0", "version": "0.58b0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "packaging", "purl": "pkg:pypi/packaging@25.0", "version": "25.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "peewee", "purl": "pkg:pypi/peewee@3.19.0", "version": "3.19.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "platformdirs", "purl": "pkg:pypi/platformdirs@4.12.1", "version": "4.12.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pluggy", "purl": "pkg:pypi/pluggy@1.6.0", "version": "1.6.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "pre-commit", "purl": "pkg:pypi/pre-commit@4.6.2", "version": "4.6.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "protobuf", "purl": "pkg:pypi/protobuf@6.33.4", "version": "6.33.4" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pycparser", "purl": "pkg:pypi/pycparser@2.23", "version": "2.23" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pydantic", "purl": "pkg:pypi/pydantic@2.12.5", "version": "2.12.5" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pydantic-core", "purl": "pkg:pypi/pydantic-core@2.41.5", "version": "2.41.5" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pydantic-settings", "purl": "pkg:pypi/pydantic-settings@2.12.0", "version": "2.12.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pygments", "purl": "pkg:pypi/pygments@2.19.2", "version": "2.19.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.15.0", "version": "2.15.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pypi-parker", "purl": "pkg:pypi/pypi-parker@0.1.2", "version": "0.1.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest", "purl": "pkg:pypi/pytest@8.4.2", "version": "8.4.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-asyncio", "purl": "pkg:pypi/pytest-asyncio@1.3.0", "version": "1.3.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-freezer", "purl": "pkg:pypi/pytest-freezer@0.4.9", "version": "0.4.9" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-mock", "purl": "pkg:pypi/pytest-mock@3.15.1", "version": "3.15.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-rerunfailures", "purl": "pkg:pypi/pytest-rerunfailures@16.1", "version": "16.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-snapshot", "purl": "pkg:pypi/pytest-snapshot@0.9.0", "version": "0.9.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-split", "purl": "pkg:pypi/pytest-split@0.10.0", "version": "0.10.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-timeout", "purl": "pkg:pypi/pytest-timeout@2.4.0", "version": "2.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pytest-xdist", "purl": "pkg:pypi/pytest-xdist@3.8.0", "version": "3.8.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "python-dateutil", "purl": "pkg:pypi/python-dateutil@2.9.0.post0", "version": "2.9.0.post0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "python-discovery", "purl": "pkg:pypi/python-discovery@1.6.1", "version": "1.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "python-dotenv", "purl": "pkg:pypi/python-dotenv@1.2.1", "version": "1.2.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "python-multipart", "purl": "pkg:pypi/python-multipart@0.0.21", "version": "0.0.21" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "pywin32", "purl": "pkg:pypi/pywin32@311", "version": "311" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "pyyaml", "purl": "pkg:pypi/pyyaml@6.0.3", "version": "6.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "readme-renderer", "purl": "pkg:pypi/readme-renderer@44.0", "version": "44.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "referencing", "purl": "pkg:pypi/referencing@0.37.0", "version": "0.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "release", "purl": "pkg:pypi/release@0.1.0", "version": "0.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "requests", "purl": "pkg:pypi/requests@2.32.5", "version": "2.32.5" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "requests-mock", "purl": "pkg:pypi/requests-mock@1.12.1", "version": "1.12.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "rich", "purl": "pkg:pypi/rich@13.5.3", "version": "13.5.3" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "rpds-py", "purl": "pkg:pypi/rpds-py@0.30.0", "version": "0.30.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "ruamel-yaml", "purl": "pkg:pypi/ruamel-yaml@0.19.1", "version": "0.19.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "ruamel-yaml-clib", "purl": "pkg:pypi/ruamel-yaml-clib@0.2.15", "version": "0.2.15" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "semantic-version", "purl": "pkg:pypi/semantic-version@2.10.0", "version": "2.10.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "semgrep", "purl": "pkg:pypi/semgrep@1.183.0", "version": "1.183.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "setuptools", "purl": "pkg:pypi/setuptools@80.10.2", "version": "80.10.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "six", "purl": "pkg:pypi/six@1.17.0", "version": "1.17.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "sse-starlette", "purl": "pkg:pypi/sse-starlette@3.2.0", "version": "3.2.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "starlette", "purl": "pkg:pypi/starlette@0.52.1", "version": "0.52.1" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "tomli", "purl": "pkg:pypi/tomli@2.4.1", "version": "2.4.1" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "towncrier", "purl": "pkg:pypi/towncrier@25.8.0", "version": "25.8.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-appdirs", "purl": "pkg:pypi/types-appdirs@1.4.3.5", "version": "1.4.3.5" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-colorama", "purl": "pkg:pypi/types-colorama@0.4.15.20250801", "version": "0.4.15.20250801" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-freezegun", "purl": "pkg:pypi/types-freezegun@1.1.10", "version": "1.1.10" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-jinja2", "purl": "pkg:pypi/types-jinja2@2.11.9", "version": "2.11.9" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-jsonschema", "purl": "pkg:pypi/types-jsonschema@4.25.1.20251009", "version": "4.25.1.20251009" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-markupsafe", "purl": "pkg:pypi/types-markupsafe@1.1.10", "version": "1.1.10" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-python-dateutil", "purl": "pkg:pypi/types-python-dateutil@2.9.0.20251115", "version": "2.9.0.20251115" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-requests", "purl": "pkg:pypi/types-requests@2.32.4.20260107", "version": "2.32.4.20260107" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "types-setuptools", "purl": "pkg:pypi/types-setuptools@80.9.0.20251223", "version": "80.9.0.20251223" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "typing-extensions", "purl": "pkg:pypi/typing-extensions@4.15.0", "version": "4.15.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "typing-extensions", "purl": "pkg:pypi/typing-extensions@4.16.0", "version": "4.16.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "typing-inspection", "purl": "pkg:pypi/typing-inspection@0.4.2", "version": "0.4.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "urllib3", "purl": "pkg:pypi/urllib3@2.8.0", "version": "2.8.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "uvicorn", "purl": "pkg:pypi/uvicorn@0.40.0", "version": "0.40.0" }, { "ecosystem": "pypi", "licenses": [], "location": "scripts/release/uv.lock", "name": "virtualenv", "purl": "pkg:pypi/virtualenv@21.13.0", "version": "21.13.0" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "wcmatch", "purl": "pkg:pypi/wcmatch@8.5.2", "version": "8.5.2" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "wrapt", "purl": "pkg:pypi/wrapt@1.17.3", "version": "1.17.3" }, { "ecosystem": "pypi", "licenses": [], "location": "cli/uv.lock", "name": "zipp", "purl": "pkg:pypi/zipp@3.23.0", "version": "3.23.0" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/tests.yml", "name": "./.github/workflows/build-test-core-x86.yml", "purl": "", "version": "UNKNOWN" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/tests.yml", "name": "./.github/workflows/build-test-docker.yml", "purl": "", "version": "UNKNOWN" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/tests.yml", "name": "./.github/workflows/build-test-osx-arm64.yml", "purl": "", "version": "UNKNOWN" } ], "description": "Scan source code with multi-language static-analysis rules", "errors": [], "excluded_matches": { "package defined in the repository itself": 1 }, "id": "semgrep__semgrep", "manifests": [ ".github/workflows/build-test-core-x86.yml", ".github/workflows/build-test-docker.yml", ".github/workflows/build-test-osx-arm64.yml", ".github/workflows/lint.yml", ".github/workflows/nightly.yml", ".github/workflows/ocaml-tree-sitter-ci.yml", ".github/workflows/ocaml-tree-sitter-test-languages.yml", ".github/workflows/pr-checklist.yaml", ".github/workflows/scanner-memory-safety.yml", ".github/workflows/sync-with-PRO.yml", ".github/workflows/test-e2e-semgrep-ci.yml", ".github/workflows/tests.yml", ".github/workflows/trigger-semgrep-comparison-argo.yml", "cli/pyproject.toml", "cli/setup.py", "cli/src/semgrep/semgrep_interfaces/semgrep-interfaces.opam", "cli/uv.lock", "dev/optional.opam", "dev/required.opam", "libs/ocaml-tree-sitter-semgrep/core/tree-sitter.opam", "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "libs/python-str-repr/python-str-repr.opam", "scripts/release/pyproject.toml", "scripts/release/uv.lock", "semgrep.opam", "setup.py" ], "name": "semgrep", "osv": { "advisories": 71, "available": true, "confirmed": 71, "osv_only": [], "warning": null }, "ref": "v1.183.0", "ref_kind": "release", "release_integrity": { "assets": 0, "checksums_published": false, "methods": [], "provenance_published": false, "sbom_published": false, "signatures_published": false, "verdict": "no-assets" }, "released_at": "2026-10-29T21:29:24Z", "repository": "semgrep/semgrep", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 263 shared packages \u2014 no actual upgrades", "Core system packages stable: pypi (124), npm (69), github (39), file (22) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:09:31+00:00", "scorecard": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "vulnerabilities": [ { "aliases": [ "CVE-2021-44906" ], "ecosystem": "npm", "epss": { "cve": "CVE-2021-44906", "percentile": 0.91634, "score": 0.04581 }, "fix_state": "fixed", "fixed_in": [ "1.2.6" ], "id": "GHSA-xvch-5gv4-984h", "kev": null, "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": true, "package": "minimist", "severity": "Critical", "summary": "Prototype Pollution in minimist", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "version": "1.2.5" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "48.0.1" ], "id": "GHSA-537c-gmf6-5ccf", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "High", "summary": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "version": "46.0.3" }, { "aliases": [ "CVE-2026-69247" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-69247", "percentile": 0.19874, "score": 0.00274 }, "fix_state": "fixed", "fixed_in": [ "50.0.0" ], "id": "GHSA-g6cj-pr64-35w5", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "High", "summary": "cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing", "url": "https://github.com/advisories/GHSA-g6cj-pr64-35w5", "version": "46.0.3" }, { "aliases": [ "CVE-2026-69249" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-69249", "percentile": 0.17998, "score": 0.00262 }, "fix_state": "fixed", "fixed_in": [ "49.0.0" ], "id": "GHSA-jwv3-5hgf-82ww", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "High", "summary": "python-cryptography: Duplicate self-signed intermediates can cause exponential path-building", "url": "https://github.com/advisories/GHSA-jwv3-5hgf-82ww", "version": "46.0.3" }, { "aliases": [ "CVE-2026-26007" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-26007", "percentile": 0.331, "score": 0.0039 }, "fix_state": "fixed", "fixed_in": [ "46.0.5" ], "id": "GHSA-r6ph-v2qm-q3c2", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "High", "summary": "cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://github.com/advisories/GHSA-r6ph-v2qm-q3c2", "version": "46.0.3" }, { "aliases": [ "CVE-2026-116588" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-116588", "percentile": 0.40503, "score": 0.00468 }, "fix_state": "fixed", "fixed_in": [ "4.15.6" ], "id": "GHSA-3633-r77q-h3v3", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "ddtrace", "severity": "High", "summary": "Datadog dd-trace-py: ReDoS in URL query string obfuscation", "url": "https://github.com/advisories/GHSA-3633-r77q-h3v3", "version": "4.2.1" }, { "aliases": [ "CVE-2026-50271" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-50271", "percentile": 0.56357, "score": 0.00793 }, "fix_state": "fixed", "fixed_in": [ "4.8.2" ], "id": "GHSA-mw54-j2v2-42hr", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "ddtrace", "severity": "High", "summary": "dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS", "url": "https://github.com/advisories/GHSA-mw54-j2v2-42hr", "version": "4.2.1" }, { "aliases": [ "CVE-2026-116589" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-116589", "percentile": 0.25891, "score": 0.00328 }, "fix_state": "fixed", "fixed_in": [ "4.15.5" ], "id": "GHSA-p3m5-h5v9-vqj6", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "ddtrace", "severity": "High", "summary": "Datadog dd-trace-py: IAST instrumentation can lead to application DOS", "url": "https://github.com/advisories/GHSA-p3m5-h5v9-vqj6", "version": "4.2.1" }, { "aliases": [ "CVE-2026-112940" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112940", "percentile": 0.08746, "score": 0.0019 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-v4x8-3wr5-3wq8", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "High", "summary": "filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files", "url": "https://github.com/advisories/GHSA-v4x8-3wr5-3wq8", "version": "4.0.6" }, { "aliases": [ "CVE-2026-0994" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-0994", "percentile": 0.53608, "score": 0.00712 }, "fix_state": "fixed", "fixed_in": [ "6.33.5" ], "id": "GHSA-7gcm-g887-7qv7", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "protobuf", "severity": "High", "summary": "protobuf affected by a JSON recursion depth bypass", "url": "https://github.com/advisories/GHSA-7gcm-g887-7qv7", "version": "6.33.4" }, { "aliases": [ "CVE-2026-53539" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-53539", "percentile": 0.39873, "score": 0.0046 }, "fix_state": "fixed", "fixed_in": [ "0.0.30" ], "id": "GHSA-5rvq-cxj2-64vf", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "High", "summary": "python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service", "url": "https://github.com/advisories/GHSA-5rvq-cxj2-64vf", "version": "0.0.21" }, { "aliases": [ "CVE-2026-42561" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-42561", "percentile": 0.54639, "score": 0.0074 }, "fix_state": "fixed", "fixed_in": [ "0.0.27" ], "id": "GHSA-pp6c-gr5w-3c5g", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "High", "summary": "python-multipart has Denial of Service via unbounded multipart part headers", "url": "https://github.com/advisories/GHSA-pp6c-gr5w-3c5g", "version": "0.0.21" }, { "aliases": [ "CVE-2026-24486" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-24486", "percentile": 0.82568, "score": 0.02206 }, "fix_state": "fixed", "fixed_in": [ "0.0.22" ], "id": "GHSA-wp53-j4wj-2cfg", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "High", "summary": "Python-Multipart has Arbitrary File Write via Non-Default Configuration", "url": "https://github.com/advisories/GHSA-wp53-j4wj-2cfg", "version": "0.0.21" }, { "aliases": [ "CVE-2022-25883" ], "ecosystem": "npm", "epss": { "cve": "CVE-2022-25883", "percentile": 0.86273, "score": 0.02761 }, "fix_state": "fixed", "fixed_in": [ "5.7.2" ], "id": "GHSA-c2qf-rxjj-qqgw", "kev": null, "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": true, "package": "semver", "severity": "High", "summary": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "version": "5.7.1" }, { "aliases": [ "CVE-2022-0355" ], "ecosystem": "npm", "epss": { "cve": "CVE-2022-0355", "percentile": 0.80993, "score": 0.02024 }, "fix_state": "fixed", "fixed_in": [ "3.1.1" ], "id": "GHSA-wpg7-2c88-r8xv", "kev": null, "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": true, "package": "simple-get", "severity": "High", "summary": "Exposure of Sensitive Information in simple-get", "url": "https://github.com/advisories/GHSA-wpg7-2c88-r8xv", "version": "3.1.0" }, { "aliases": [ "CVE-2026-54283" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54283", "percentile": 0.41471, "score": 0.00481 }, "fix_state": "fixed", "fixed_in": [ "1.3.1" ], "id": "GHSA-82w8-qh3p-5jfq", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "starlette", "severity": "High", "summary": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "url": "https://github.com/advisories/GHSA-82w8-qh3p-5jfq", "version": "0.52.1" }, { "aliases": [ "CVE-2026-48818" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-48818", "percentile": 0.3067, "score": 0.00368 }, "fix_state": "fixed", "fixed_in": [ "1.1.0" ], "id": "GHSA-wqp7-x3pw-xc5r", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "starlette", "severity": "High", "summary": "Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "url": "https://github.com/advisories/GHSA-wqp7-x3pw-xc5r", "version": "0.52.1" }, { "aliases": [ "CVE-2025-48387" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-48387", "percentile": 0.47656, "score": 0.00579 }, "fix_state": "fixed", "fixed_in": [ "2.1.3" ], "id": "GHSA-8cj5-5rvv-wf4v", "kev": null, "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": true, "package": "tar-fs", "severity": "High", "summary": "tar-fs can extract outside the specified dir with a specific tarball", "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v", "version": "2.1.1" }, { "aliases": [ "CVE-2024-12905" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-12905", "percentile": 0.83296, "score": 0.02299 }, "fix_state": "fixed", "fixed_in": [ "2.1.2" ], "id": "GHSA-pq67-2wwv-3xjx", "kev": null, "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": true, "package": "tar-fs", "severity": "High", "summary": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File", "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx", "version": "2.1.1" }, { "aliases": [ "CVE-2025-59343" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-59343", "percentile": 0.46196, "score": 0.00553 }, "fix_state": "fixed", "fixed_in": [ "2.1.4" ], "id": "GHSA-vj76-c3g6-qr5v", "kev": null, "location": "libs/ocaml-tree-sitter-semgrep/lang/semgrep-grammars/package-lock.json", "osv_confirmed": true, "package": "tar-fs", "severity": "High", "summary": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "version": "2.1.1" }, { "aliases": [ "CVE-2026-113718" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113718", "percentile": 0.15459, "score": 0.00242 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-394h-qwmc-48pf", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv: Xonsh activation literals depend on the script decoding codec", "url": "https://github.com/advisories/GHSA-394h-qwmc-48pf", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113726" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113726", "percentile": 0.28043, "score": 0.00345 }, "fix_state": "fixed", "fixed_in": [ "21.14.4" ], "id": "GHSA-5vjq-rrrf-7h2q", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST", "url": "https://github.com/advisories/GHSA-5vjq-rrrf-7h2q", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113723" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113723", "percentile": 0.15459, "score": 0.00242 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-6w3r-xr62-4xcp", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv: Bash prompt values can change meaning under older compatibility modes", "url": "https://github.com/advisories/GHSA-6w3r-xr62-4xcp", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113776" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113776", "percentile": 0.19099, "score": 0.00269 }, "fix_state": "fixed", "fixed_in": [ "21.14.2" ], "id": "GHSA-8rjx-v5ww-45pp", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv activation scripts run code from a path that contains a placeholder name", "url": "https://github.com/advisories/GHSA-8rjx-v5ww-45pp", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113732" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113732", "percentile": 0.14706, "score": 0.00236 }, "fix_state": "fixed", "fixed_in": [ "21.14.2" ], "id": "GHSA-c947-3pg5-gm8q", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote", "url": "https://github.com/advisories/GHSA-c947-3pg5-gm8q", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113722" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113722", "percentile": 0.21101, "score": 0.00285 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-c978-59m8-c77v", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax", "url": "https://github.com/advisories/GHSA-c978-59m8-c77v", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113725" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113725", "percentile": 0.1824, "score": 0.00263 }, "fix_state": "fixed", "fixed_in": [ "21.14.7" ], "id": "GHSA-vxj4-q4g9-crj7", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "High", "summary": "virtualenv bash activate runs commands from an environment name with a backslash before $", "url": "https://github.com/advisories/GHSA-vxj4-q4g9-crj7", "version": "21.13.0" }, { "aliases": [ "CVE-2026-69248" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-69248", "percentile": 0.15614, "score": 0.00244 }, "fix_state": "fixed", "fixed_in": [ "49.0.0" ], "id": "GHSA-m2h6-j472-rp4c", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "Medium", "summary": "python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees", "url": "https://github.com/advisories/GHSA-m2h6-j472-rp4c", "version": "46.0.3" }, { "aliases": [ "CVE-2026-39892" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-39892", "percentile": 0.5125, "score": 0.00652 }, "fix_state": "fixed", "fixed_in": [ "46.0.7" ], "id": "GHSA-p423-j2cm-9vmq", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "Medium", "summary": "Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs", "url": "https://github.com/advisories/GHSA-p423-j2cm-9vmq", "version": "46.0.3" }, { "aliases": [ "CVE-2026-112908" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-6627-m3xw-93mp", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold", "url": "https://github.com/advisories/GHSA-6627-m3xw-93mp", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112909" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112909", "percentile": 0.12637, "score": 0.0022 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-69hj-f68j-2879", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path", "url": "https://github.com/advisories/GHSA-69hj-f68j-2879", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112910" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-8mx5-7m5m-r77g", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL", "url": "https://github.com/advisories/GHSA-8mx5-7m5m-r77g", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112911" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112911", "percentile": 0.03966, "score": 0.00148 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-9c4x-gm8v-wgc4", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion", "url": "https://github.com/advisories/GHSA-9c4x-gm8v-wgc4", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112915" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112915", "percentile": 0.1226, "score": 0.00218 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-cwqr-hh33-gh44", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout", "url": "https://github.com/advisories/GHSA-cwqr-hh33-gh44", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112934" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112934", "percentile": 0.14204, "score": 0.00233 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-fj95-fr6c-h845", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record", "url": "https://github.com/advisories/GHSA-fj95-fr6c-h845", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112935" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112935", "percentile": 0.02761, "score": 0.00132 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-fq56-3cx3-fjxp", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders", "url": "https://github.com/advisories/GHSA-fq56-3cx3-fjxp", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112936" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112936", "percentile": 0.14138, "score": 0.00232 }, "fix_state": "fixed", "fixed_in": [ "4.0.9" ], "id": "GHSA-j8f7-rjxc-mr56", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: ReadWriteLock follows a symlink at the lock path into SQLite", "url": "https://github.com/advisories/GHSA-j8f7-rjxc-mr56", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112938" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-m462-7rxw-wvpg", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses", "url": "https://github.com/advisories/GHSA-m462-7rxw-wvpg", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112939" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112939", "percentile": 0.03305, "score": 0.0014 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-rfpc-qcw5-3pc4", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Medium", "summary": "filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker", "url": "https://github.com/advisories/GHSA-rfpc-qcw5-3pc4", "version": "4.0.6" }, { "aliases": [ "CVE-2026-45409" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-45409", "percentile": 0.35091, "score": 0.00408 }, "fix_state": "fixed", "fixed_in": [ "3.15" ], "id": "GHSA-65pc-fj4g-8rjx", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "idna", "severity": "Medium", "summary": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix", "url": "https://github.com/advisories/GHSA-65pc-fj4g-8rjx", "version": "3.11" }, { "aliases": [ "CVE-2026-116685" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-116685", "percentile": 0.3417, "score": 0.00399 }, "fix_state": "fixed", "fixed_in": [ "1.30.0" ], "id": "GHSA-5h93-6whr-6q8j", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "mcp", "severity": "Medium", "summary": "Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies", "url": "https://github.com/advisories/GHSA-5h93-6whr-6q8j", "version": "1.29.0" }, { "aliases": [ "CVE-2026-59951" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-59951", "percentile": 0.39721, "score": 0.00458 }, "fix_state": "fixed", "fixed_in": [ "1.30.0" ], "id": "GHSA-84m7-p3x7-pcfv", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "mcp", "severity": "Medium", "summary": "MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion", "url": "https://github.com/advisories/GHSA-84m7-p3x7-pcfv", "version": "1.29.0" }, { "aliases": [ "CVE-2026-116686" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-116686", "percentile": 0.27118, "score": 0.00337 }, "fix_state": "fixed", "fixed_in": [ "1.30.0" ], "id": "GHSA-rwrf-2pqf-9j8j", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "mcp", "severity": "Medium", "summary": "Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas", "url": "https://github.com/advisories/GHSA-rwrf-2pqf-9j8j", "version": "1.29.0" }, { "aliases": [ "CVE-2026-116684" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-116684", "percentile": 0.30372, "score": 0.00365 }, "fix_state": "fixed", "fixed_in": [ "1.30.0" ], "id": "GHSA-w4fh-qvv9-3v23", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "mcp", "severity": "Medium", "summary": "Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server", "url": "https://github.com/advisories/GHSA-w4fh-qvv9-3v23", "version": "1.29.0" }, { "aliases": [ "CVE-2026-114603" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-114603", "percentile": 0.41947, "score": 0.00487 }, "fix_state": "fixed", "fixed_in": [ "1.45.1" ], "id": "GHSA-xcq7-p3pf-p88h", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "opentelemetry-api", "severity": "Medium", "summary": "OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api", "url": "https://github.com/advisories/GHSA-xcq7-p3pf-p88h", "version": "1.37.0" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "2.14.2" ], "id": "GHSA-4xgf-cpjx-pc3j", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "pydantic-settings", "severity": "Medium", "summary": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size", "url": "https://github.com/advisories/GHSA-4xgf-cpjx-pc3j", "version": "2.12.0" }, { "aliases": [ "CVE-2025-71176" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2025-71176", "percentile": 0.0448, "score": 0.00154 }, "fix_state": "fixed", "fixed_in": [ "9.0.3" ], "id": "GHSA-6w46-j5rx-g56g", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "pytest", "severity": "Medium", "summary": "pytest has vulnerable tmpdir handling", "url": "https://github.com/advisories/GHSA-6w46-j5rx-g56g", "version": "8.4.2" }, { "aliases": [ "CVE-2026-28684" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-28684", "percentile": 0.16768, "score": 0.00252 }, "fix_state": "fixed", "fixed_in": [ "1.2.2" ], "id": "GHSA-mf9w-mj56-hr94", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-dotenv", "severity": "Medium", "summary": "python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback", "url": "https://github.com/advisories/GHSA-mf9w-mj56-hr94", "version": "1.2.1" }, { "aliases": [ "CVE-2026-40347" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-40347", "percentile": 0.28742, "score": 0.00351 }, "fix_state": "fixed", "fixed_in": [ "0.0.26" ], "id": "GHSA-mj87-hwqh-73pj", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "Medium", "summary": "python-multipart affected by Denial of Service via large multipart preamble or epilogue data", "url": "https://github.com/advisories/GHSA-mj87-hwqh-73pj", "version": "0.0.21" }, { "aliases": [ "CVE-2026-25645" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-25645", "percentile": 0.08606, "score": 0.00189 }, "fix_state": "fixed", "fixed_in": [ "2.33.0" ], "id": "GHSA-gc5v-m9x4-r6x2", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "requests", "severity": "Medium", "summary": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function", "url": "https://github.com/advisories/GHSA-gc5v-m9x4-r6x2", "version": "2.32.5" }, { "aliases": [ "CVE-2026-59890" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-59890", "percentile": 0.34795, "score": 0.00405 }, "fix_state": "fixed", "fixed_in": [ "83.0.0" ], "id": "GHSA-h35f-9h28-mq5c", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "setuptools", "severity": "Medium", "summary": "setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+", "url": "https://github.com/advisories/GHSA-h35f-9h28-mq5c", "version": "80.10.2" }, { "aliases": [ "CVE-2026-48710" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-48710", "percentile": 0.99383, "score": 0.70288 }, "fix_state": "fixed", "fixed_in": [ "1.0.1" ], "id": "GHSA-86qp-5c8j-p5mr", "kev": { "cve": "CVE-2026-48710", "date_added": "2026-09-02" }, "location": "cli/uv.lock", "osv_confirmed": true, "package": "starlette", "severity": "Medium", "summary": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "url": "https://github.com/advisories/GHSA-86qp-5c8j-p5mr", "version": "0.52.1" }, { "aliases": [ "CVE-2026-48817" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-48817", "percentile": 0.116, "score": 0.00213 }, "fix_state": "fixed", "fixed_in": [ "1.1.0" ], "id": "GHSA-x746-7m8f-x49c", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "starlette", "severity": "Medium", "summary": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`", "url": "https://github.com/advisories/GHSA-x746-7m8f-x49c", "version": "0.52.1" }, { "aliases": [ "CVE-2026-113724" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113724", "percentile": 0.10341, "score": 0.00203 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-43mp-35q3-x3fq", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Medium", "summary": "virtualenv: Deletion recovery can change a symlink target's mode", "url": "https://github.com/advisories/GHSA-43mp-35q3-x3fq", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113721" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113721", "percentile": 0.03666, "score": 0.00144 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-558c-9hv2-4prj", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Medium", "summary": "virtualenv: Generated files can follow existing destination links", "url": "https://github.com/advisories/GHSA-558c-9hv2-4prj", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113716" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113716", "percentile": 0.03665, "score": 0.00144 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-cw65-gx24-rc82", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Medium", "summary": "virtualenv: Builtin creation follows linked environment directories", "url": "https://github.com/advisories/GHSA-cw65-gx24-rc82", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113720" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113720", "percentile": 0.02859, "score": 0.00134 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-fc2g-4w5p-6whm", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Medium", "summary": "virtualenv: Seeded files retain permissions from an older cache", "url": "https://github.com/advisories/GHSA-fc2g-4w5p-6whm", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113719" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113719", "percentile": 0.10341, "score": 0.00203 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-hhxq-47xx-j5xx", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Medium", "summary": "virtualenv: Seed replacement does not contain metadata deletion paths", "url": "https://github.com/advisories/GHSA-hhxq-47xx-j5xx", "version": "21.13.0" }, { "aliases": [ "CVE-2026-34073" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-34073", "percentile": 0.13508, "score": 0.00227 }, "fix_state": "fixed", "fixed_in": [ "46.0.6" ], "id": "GHSA-m959-cc7f-wv43", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "cryptography", "severity": "Low", "summary": "cryptography has incomplete DNS name constraint enforcement on peer names", "url": "https://github.com/advisories/GHSA-m959-cc7f-wv43", "version": "46.0.3" }, { "aliases": [ "CVE-2026-112907" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-567q-5qvw-pf92", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Low", "summary": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "url": "https://github.com/advisories/GHSA-567q-5qvw-pf92", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112912" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-112912", "percentile": 0.11672, "score": 0.00213 }, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-9j6q-wvj5-jgjg", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Low", "summary": "filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker", "url": "https://github.com/advisories/GHSA-9j6q-wvj5-jgjg", "version": "4.0.6" }, { "aliases": [ "CVE-2026-112913" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-9vhv-jxww-xfm5", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Low", "summary": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "url": "https://github.com/advisories/GHSA-9vhv-jxww-xfm5", "version": "4.0.6" }, { "aliases": [ "CVE-2026-4539" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-4539", "percentile": 0.05024, "score": 0.00159 }, "fix_state": "fixed", "fixed_in": [ "2.20.0" ], "id": "GHSA-5239-wwwm-4pmq", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "pygments", "severity": "Low", "summary": "Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching", "url": "https://github.com/advisories/GHSA-5239-wwwm-4pmq", "version": "2.19.2" }, { "aliases": [ "CVE-2026-53538" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-53538", "percentile": 0.17206, "score": 0.00256 }, "fix_state": "fixed", "fixed_in": [ "0.0.30" ], "id": "GHSA-6jv3-5f52-599m", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "Low", "summary": "python-multipart: Semicolon treated as querystring field separator enables parameter smuggling", "url": "https://github.com/advisories/GHSA-6jv3-5f52-599m", "version": "0.0.21" }, { "aliases": [ "CVE-2026-53540" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-53540", "percentile": 0.27758, "score": 0.00342 }, "fix_state": "fixed", "fixed_in": [ "0.0.31" ], "id": "GHSA-v9pg-7xvm-68hf", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "Low", "summary": "python-multipart: Negative Content-Length in parse_form buffers the entire body in memory", "url": "https://github.com/advisories/GHSA-v9pg-7xvm-68hf", "version": "0.0.21" }, { "aliases": [ "CVE-2026-53537" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-53537", "percentile": 0.21757, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "0.0.30" ], "id": "GHSA-vffw-93wf-4j4q", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "python-multipart", "severity": "Low", "summary": "python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters", "url": "https://github.com/advisories/GHSA-vffw-93wf-4j4q", "version": "0.0.21" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "84.1.0" ], "id": "GHSA-xmj3-9gf7-h52w", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "setuptools", "severity": "Low", "summary": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "version": "80.10.2" }, { "aliases": [ "CVE-2026-54282" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54282", "percentile": 0.19733, "score": 0.00273 }, "fix_state": "fixed", "fixed_in": [ "1.3.0" ], "id": "GHSA-jp82-jpqv-5vv3", "kev": null, "location": "cli/uv.lock", "osv_confirmed": true, "package": "starlette", "severity": "Low", "summary": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname", "url": "https://github.com/advisories/GHSA-jp82-jpqv-5vv3", "version": "0.52.1" }, { "aliases": [ "CVE-2026-113714" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113714", "percentile": 0.16325, "score": 0.00249 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-494p-63j8-28p3", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Low", "summary": "virtualenv: Downloaded wheel selection and caching precede verification", "url": "https://github.com/advisories/GHSA-494p-63j8-28p3", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113717" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113717", "percentile": 0.21916, "score": 0.00293 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-cx28-75q4-x26q", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Low", "summary": "virtualenv: Pip seeding with download omits wheel digest verification", "url": "https://github.com/advisories/GHSA-cx28-75q4-x26q", "version": "21.13.0" }, { "aliases": [ "CVE-2026-113715" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-113715", "percentile": 0.15459, "score": 0.00242 }, "fix_state": "fixed", "fixed_in": [ "21.14.9" ], "id": "GHSA-qmx5-4p3x-wvqf", "kev": null, "location": "scripts/release/uv.lock", "osv_confirmed": true, "package": "virtualenv", "severity": "Low", "summary": "virtualenv: Venv configuration readback can reinterpret path boundaries", "url": "https://github.com/advisories/GHSA-qmx5-4p3x-wvqf", "version": "21.13.0" } ], "workflow_audit": { "files": 13, "findings": [ { "confidence": "Medium", "description": "use of fundamentally insecure workflow trigger", "file": ".github/workflows/pr-checklist.yaml", "line": 24, "note": "this workflow", "rule": "dangerous-triggers", "severity": "High", "url": "https://docs.zizmor.sh/audits/#dangerous-triggers" }, { "confidence": "High", "description": "dangerous use of GitHub App tokens", "file": ".github/workflows/sync-with-PRO.yml", "line": 11, "note": "app token inherits blanket installation permissions", "rule": "github-app", "severity": "High", "url": "https://docs.zizmor.sh/audits/#github-app" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/sync-with-PRO.yml", "line": 31, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/sync-with-PRO.yml", "line": 103, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "dangerous use of GitHub App tokens", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 101, "note": "app token inherits blanket installation permissions", "rule": "github-app", "severity": "High", "url": "https://docs.zizmor.sh/audits/#github-app" }, { "confidence": "High", "description": "dangerous use of GitHub App tokens", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 132, "note": "app token inherits blanket installation permissions", "rule": "github-app", "severity": "High", "url": "https://docs.zizmor.sh/audits/#github-app" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/tests.yml", "line": 283, "note": "contents: write is overly broad at the workflow level", "rule": "excessive-permissions", "severity": "High", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/tests.yml", "line": 284, "note": "id-token: write is overly broad at the workflow level", "rule": "excessive-permissions", "severity": "High", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/build-test-core-x86.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/build-test-osx-arm64.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/lint.yml", "line": 2, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/lint.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/lint.yml", "line": 14, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/lint.yml", "line": 26, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/nightly.yml", "line": 2, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/nightly.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/nightly.yml", "line": 20, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/ocaml-tree-sitter-ci.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/ocaml-tree-sitter-test-languages.yml", "line": 2, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/ocaml-tree-sitter-test-languages.yml", "line": 151, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "code injection via template expansion", "file": ".github/workflows/ocaml-tree-sitter-test-languages.yml", "line": 214, "note": "this step", "rule": "template-injection", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/ocaml-tree-sitter-test-languages.yml", "line": 227, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/scanner-memory-safety.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 2, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 19, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 42, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 52, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 68, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 93, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 126, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/trigger-semgrep-comparison-argo.yml", "line": 2, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/trigger-semgrep-comparison-argo.yml", "line": 3, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/trigger-semgrep-comparison-argo.yml", "line": 22, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/trigger-semgrep-comparison-argo.yml", "line": 43, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/test-e2e-semgrep-ci.yml", "line": 9, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/tests.yml", "line": 37, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/tests.yml", "line": 39, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/tests.yml", "line": 41, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" } ] } }, "updated": "2026-11-02" }