Supply-chain report: week of 2026-11-02
| Project | Version scanned | Dependencies | Critical | High | Medium | Low | Unknown | Vulnerable packages | Fixable | KEV | In binary | Scorecard | Workflow | Release | Change since last week |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| safe-chain Software Composition Analysis (SCA) | 1.5.27 | 280 | 0 | 6 | 6 | 3 | 0 | 4 | 14 | 0 | — | 4.5* | 18 | immutable release only | 273 added; 15 new advisories; 1 resolved |
| njsscan Static Application Security Testing (SAST) › Language-specific › JavaScript/Node.js | 1.0.2 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 5.5 | 0 | no release files | no change |
| grype Software Composition Analysis (SCA) | v0.121.0 | 375 | 0 | 4 | 2 | 0 | 3 | 4 | 3 | 0 | 21 | 7.9* | 0 | verified | no change |
| syft SBOM Generation | v1.55.0 | 355 | 0 | 1 | 0 | 0 | 3 | 3 | 3 | 0 | 16 | 8.7 | 0 | verified | 27 removed; 45 resolved |
| kube-bench Kubernetes Security | v0.16.0 | 101 | 1 | 5 | 0 | 0 | 2 | 2 | 8 | 0 | 29 | 5.8* | 1 | checksums only | no change |
| tracee Container Security › Runtime Security | v0.24.1 | 194 | 12 | 34 | 30 | 3 | 5 | 14 | 74 | 0 | 57 | 7.0* | 14 | checksums only | no change |
| trivy Software Composition Analysis (SCA) | v0.76.1 | 509 | 0 | 4 | 3 | 0 | 3 | 5 | 3 | 0 | 3 | 7.1* | 1 | verified | no change |
| trivy-operator Kubernetes Security | v0.36.1 | 425 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 1 | 7.5* | 1 | verified | no change |
| Dark-Moon API & Dynamic Testing (DAST) | v1.6.0 | 0 | no dependencies found to match | 0 | 0 | — | — | 3.8† | 0 | no release files | no change | ||||
| cfn-lint Infrastructure as Code Security | v1.59.0 | 7 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.0* | 28 | no Linux binary | 2 resolved |
| bearer Static Application Security Testing (SAST) › Multi-language | v2.1.3 | 146 | 0 | 0 | 1 | 0 | 3 | 3 | 3 | 0 | 2 | 6.3 | 6 | checksums only | no change |
| sealed-secrets Secret Management | v0.41.2 | 102 | 0 | 0 | 0 | 0 | 3 | 2 | 2 | 0 | 0 | 6.8 | 5 | signed, not by a project workflow | no change |
| checkov Infrastructure as Code Security | 3.4.0 | 133 | 2 | 47 | 32 | 5 | 0 | 11 | 85 | 0 | — | — | 10 | no checksums or signatures | 4 resolved |
| kics Infrastructure as Code Security | v2.2.0 | 301 | 3 | 6 | 4 | 2 | 3 | 6 | 13 | 0 | — | — | 0 | no release files | 72 removed; 8 resolved |
| tetragon Container Security › Runtime Security | v1.8.0 | 220 | 0 | 3 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | — | 33 | no checksums or signatures | no change |
| cloudquery Cloud Security | cli-v6.49.2 | 975 | 3 | 32 | 27 | 5 | 6 | 25 | 65 | 0 | 8 | 6.0 | 14 | checksums only | no change |
| cdxgen SBOM Generation | v13.6.0 | 329 | 1 | 4 | 6 | 2 | 0 | 8 | 13 | 0 | — | — | 1 | checksums only | no change |
| cyclonedx-cli SBOM Generation | v0.33.1 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 21 | no checksums or signatures | no change |
| dependency-track Software Composition Analysis (SCA) | 5.2.1 | 211 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 7.5 | 0 | no Linux binary | 1 removed |
| bomber Software Composition Analysis (SCA) | v0.5.1 | 44 | 1 | 13 | 10 | 1 | 2 | 5 | 27 | 0 | 83 | — | 7 | checksums only | no change |
| docker-bench-security Container Security › Image Scanning | v1.6.1 | 6 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.7 | 1 | no Linux binary | no change |
| sysdig-inspect Container Security › Runtime Security | 0.12.1 | 2329 | 27 | 194 | 155 | 41 | 0 | 166 | 390 | 1 | — | — | 17 | no Linux binary | 1664 added; 185 new advisories; 1 resolved |
| eslint-plugin-security Static Application Security Testing (SAST) › Language-specific › JavaScript/Node.js | eslint-plugin-security-v4.2.1 | 814 | 6 | 50 | 42 | 10 | 0 | 48 | 104 | 0 | — | — | 9 | no release files | 807 added; 77 new advisories |
| external-secrets Secret Management | v2.14.0 | 529 | 1 | 5 | 2 | 2 | 3 | 8 | 12 | 0 | — | 8.3 | 16 | no Linux binary | no change |
| polaris Kubernetes Security | v10.2.5 | 81 | 1 | 5 | 0 | 0 | 2 | 2 | 8 | 0 | 16 | 5.1 | 5 | signed, not by a project workflow | no change |
| falco Container Security › Runtime Security | 0.45.2 | 41 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 7.5 | 106 | no checksums or signatures | 1 removed |
| sops Secret Management | v3.13.3 | 166 | 1 | 11 | 3 | 1 | 3 | 6 | 18 | 0 | 31 | — | 3 | verified | 41 removed |
| codeql Static Application Security Testing (SAST) › Multi-language | main (branch) | 495 | 0 | 0 | 2 | 0 | 0 | 2 | 2 | 0 | — | 5.8 | 115 | — | 2 added; 49 removed; 35 resolved |
| gitleaks Pre-commit & Secrets Detection | v8.30.1 | 83 | 7 | 9 | 8 | 1 | 1 | 6 | 25 | 0 | 70 | — | 5 | checksums only | no change |
| govulncheck Static Application Security Testing (SAST) › Language-specific › Go | v1.1.4 | 8 | 0 | 2 | 0 | 1 | 0 | 2 | 3 | 0 | — | 3.7 | 0 | no release files | no change |
| dockle Container Security › Image Scanning | v0.4.15 | 101 | 9 | 18 | 12 | 2 | 1 | 11 | 35 | 0 | 76 | 4.1 | 8 | checksums only | no change |
| osv-scanner Software Composition Analysis (SCA) | v2.7.0 | 238 | 0 | 0 | 0 | 0 | 3 | 2 | 2 | 0 | 16 | 8.6 | 5 | verified | no change |
| hadolint Container Security › Image Scanning | v2.15.1 | 17 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.7 | 47 | verified | no change |
| vault Secret Management | v2.2.1 | 650 | 0 | 12 | 9 | 0 | 4 | 8 | 19 | 0 | — | 6.5 | 202 | no release files | 1 removed |
| in-toto Supply Chain Compliance | v3.1.0 | 22 | 1 | 3 | 1 | 0 | 0 | 2 | 5 | 0 | — | 6.5 | 4 | no Linux binary | no change |
| infisical Secret Management | v0.167.4 | 3073 | 14 | 154 | 186 | 36 | 6 | 105 | 386 | 0 | — | 6.9* | 24 | no release files | 1032 added; 84 new advisories |
| kubescape Kubernetes Security | v4.0.17 | 644 | 1 | 9 | 5 | 0 | 4 | 7 | 11 | 0 | 12 | 7.6 | 1 | verified | no change |
| KubeStellar Console Kubernetes Security | v0.3.42 | 1092 | 5 | 41 | 44 | 13 | 2 | 30 | 104 | 0 | 16 | — | 19 | verified | 486 added; 28 new advisories |
| kyverno Kubernetes Security | v1.19.2 | 491 | 0 | 2 | 3 | 3 | 4 | 9 | 10 | 0 | 6 | 7.8 | 45 | verified | no change |
| cartography Cloud Security | 0.144.0 | 262 | 0 | 6 | 11 | 5 | 0 | 5 | 22 | 0 | — | 8.1 | 0 | no release files | no change |
| sbom-tool SBOM Generation | v4.1.5 | 9 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 2 | no checksums or signatures | no change |
| notation Artifact Signing & Verification | v1.3.2 | 38 | 7 | 11 | 10 | 2 | 1 | 5 | 30 | 0 | 92 | 6.5 | 1 | checksums only | no change |
| conftest Policy as Code | v0.71.1 | 181 | 1 | 5 | 2 | 0 | 3 | 3 | 10 | 0 | 16 | 7.2 | 0 | verified | no change |
| gatekeeper Policy as Code | v3.23.1 | 1296 | 4 | 84 | 50 | 17 | 3 | 55 | 155 | 0 | 44 | — | 4 | immutable release only | no change |
| opa Policy as Code | v1.22.0 | 156 | 0 | 2 | 0 | 0 | 3 | 3 | 4 | 0 | 0 | 8.2 | 1 | immutable release only | no change |
| scorecard Supply Chain Compliance | v5.6.0 | 694 | 1 | 5 | 2 | 0 | 6 | 5 | 12 | 0 | 4 | 8.6 | 4 | verified | no change |
| phpstan Static Application Security Testing (SAST) › Language-specific › PHP | 2.3.4 | 970 | 0 | 1 | 4 | 0 | 0 | 5 | 5 | 0 | — | 4.8 | 4 | no Linux binary | 635 added; 4 new advisories |
| pre-commit Pre-commit & Secrets Detection | v4.7.0 | 7 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.5 | 8 | no Linux binary | 1 removed |
| brakeman Static Application Security Testing (SAST) › Language-specific › Ruby | v8.1.0 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.0 | 5 | no release files | no change |
| nuclei API & Dynamic Testing (DAST) | v3.11.1 | 441 | 1 | 19 | 7 | 0 | 3 | 9 | 29 | 0 | 35 | 6.8 | 76 | checksums only | no change |
| prowler Cloud Security | 5.47.0 | 2034 | 1 | 22 | 55 | 9 | 0 | 47 | 87 | 0 | — | — | 1 | no release files | no change |
| bandit Static Application Security Testing (SAST) › Language-specific › Python | 1.9.4 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 5.8 | 14 | no release files | 2 resolved |
| safety Static Application Security Testing (SAST) › Language-specific › Python | 3.8.1 | 17 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.7 | 46 | no checksums or signatures | 3 resolved |
| clair Container Security › Image Scanning | v4.9.0 | 128 | 14 | 34 | 17 | 6 | 3 | 20 | 67 | 0 | 82 | 5.0 | 69 | no checksums or signatures | no change |
| sbomlyze SBOM Generation | v0.6.0 | 42 | 0 | 1 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 7.9 | 4 | verified | no change |
| cargo-audit Static Application Security Testing (SAST) › Language-specific › Rust | cargo-audit/v0.22.2 | 465 | 0 | 1 | 3 | 2 | 0 | 3 | 6 | 0 | — | — | 2 | no checksums or signatures | no change |
| vet Software Composition Analysis (SCA) | v1.20.0 | 712 | 4 | 41 | 35 | 1 | 3 | 24 | 71 | 0 | 58 | 7.4 | 5 | verified | no change |
| cloudsplaining Cloud Security | 0.9.1 | 1005 | 5 | 67 | 57 | 16 | 0 | 50 | 144 | 0 | — | 5.7 | 0 | no release files | 842 added; 95 new advisories; 1 resolved |
| gosec Static Application Security Testing (SAST) › Language-specific › Go | v2.30.0 | 79 | 0 | 0 | 0 | 0 | 3 | 2 | 2 | 0 | 0 | 6.6 | 0 | signed, not by a project workflow | no change |
| semgrep Static Application Security Testing (SAST) › Multi-language | v1.183.0 | 215 | 1 | 26 | 31 | 13 | 0 | 20 | 71 | 1 | — | — | 8 | no release files | 1 resolved |
| cosign Artifact Signing & Verification | v3.1.4 | 319 | 0 | 0 | 1 | 0 | 4 | 4 | 3 | 0 | 1 | 8.2 | 7 | signed, not by a project workflow | no change |
| rekor Artifact Signing & Verification | v1.5.5 | 270 | 1 | 5 | 0 | 0 | 6 | 5 | 10 | 0 | 0 | 8.6 | 2 | signed, not by a project workflow | no change |
| slsa-verifier Supply Chain Compliance | v2.7.1 | 1198 | 19 | 116 | 98 | 16 | 4 | 70 | 243 | 0 | 79 | — | 2 | verified | 1035 added; 132 new advisories |
| snyk-cli Software Composition Analysis (SCA) | v1.1308.3 | 1925 | 12 | 95 | 69 | 26 | 3 | 85 | 198 | 1 | 6 | — | 38 | checksums only | 1176 added; 166 new advisories; 5 resolved |
| sonarqube Static Application Security Testing (SAST) › Multi-language | 26.10.0.133078 | 3 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.9 | 1 | no release files | no change |
| spotbugs Static Application Security Testing (SAST) › Multi-language | 4.10.5 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.6 | 6 | no Linux binary | no change |
| sqlmap API & Dynamic Testing (DAST) | 1.10 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.9 | 2 | no release files | no change |
| kube-linter Kubernetes Security | v0.8.3 | 621 | 20 | 58 | 60 | 12 | 7 | 41 | 142 | 0 | 82 | 7.4 | 21 | signed, not by a project workflow | no change |
| nikto API & Dynamic Testing (DAST) | 2.6.1 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 3.8 | 7 | no release files | no change |
| talisman Pre-commit & Secrets Detection | v1.37.0 | 35 | 0 | 2 | 0 | 1 | 0 | 2 | 3 | 0 | 65 | 3.3 | 13 | checksums only | no change |
| trufflehog Pre-commit & Secrets Detection | v3.99.7 | 335 | 0 | 4 | 5 | 0 | 3 | 5 | 5 | 0 | — | 7.9 | 3 | verified | no change |
| steampipe Cloud Security | v2.4.9 | 229 | 3 | 9 | 2 | 3 | 3 | 7 | 15 | 0 | 12 | 6.8 | 14 | immutable release only | no change |
| psalm Static Application Security Testing (SAST) › Language-specific › PHP | 6.20.5 | 68 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.7 | 1 | no Linux binary | 1 resolved |
| dive Container Security › Image Scanning | v0.13.1 | 79 | 1 | 16 | 14 | 3 | 2 | 9 | 31 | 0 | 86 | 3.4 | 28 | checksums only | 1 resolved |
| wapiti API & Dynamic Testing (DAST) | 3.3.2 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 10 | no Linux binary | no change |
| detect-secrets Pre-commit & Secrets Detection | v1.5.0 | 46 | 2 | 16 | 19 | 5 | 0 | 9 | 42 | 0 | — | 3.5 | 7 | no release files | no change |
| zap API & Dynamic Testing (DAST) | v2.17.0 | 18 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.8 | 36 | no checksums or signatures | no change |
| zizmor Infrastructure as Code Security | v1.31.1 | 494 | 0 | 0 | 2 | 2 | 0 | 1 | 4 | 0 | — | — | 0 | verified | no change |
Critical … Unknown: advisory matches (one advisory can match several packages). Vulnerable packages: distinct package versions with a match, roughly the number of upgrades that clear the list. KEV: matches listed in the CISA Known Exploited Vulnerabilities catalog (— means not checked that week). In binary: Go tools only, advisories whose vulnerable functions are compiled into the released Linux binary. Scorecard: OpenSSF repository practices out of 10; * marks a score from the Scorecard CLI run by this workflow, † a score carried forward from an earlier week (hover for source and date, or for why a score is missing). Workflow: high-severity GitHub Actions findings from zizmor. Release: whether the Linux release file's signature, SLSA provenance, or GitHub attestation verifies against the project's own workflows. Select a column heading to sort.