codeql

Analyze code semantically with GitHub's query engine

github/codeql · Static Application Security Testing (SAST) › Multi-language · scanned main (default branch; no releases published) · commit 1c866c712755 · last scan 2026-11-02

495
declared dependencies
0 / 0
critical / high advisories
2
advisories with a fixed version
5.8
OpenSSF Scorecard (of 10); OpenSSF public dataset
—
release verification

Changes since last week

2 added; 49 removed; 35 resolved.

Added (2)

@types/node@24.3.1, undici-types@7.10.0

Removed (49)

actions/checkout@4, actions/checkout@v3, actions/checkout@v4, actions/github-script@v7.0.1, astral-sh/setup-uv@v3, docker/login-action@v3, foo/bar@25b062c917b0c75f8b47d8469aff6c94ffd89abb, foo/bar@v2, frabert/replace-string-action@v2.5, jwalton/gh-docker-logs@v2, lycheeverse/lychee-action@v2.0.2, nick-fields/retry@v3, example.com/test@v0.1.0, github.com/linode/linode-docs-theme@v0.0.0-20220622135843-166f108e1933, github.com/microsoft/go-mssqldb@v0.12.0, golang.org/x/net@v0.0.0-20200505041828-1ed23360d12c, golang.org/x/net@v0.23.0, golang.org/x/sys@v0.18.0, apache-jsp@9.3.3.v20150827, apache-jstl@9.3.3.v20150827, asdkfj@1.0-SNAPSHOT, commons-lang3@3.14.0, javax.servlet-api@3.1.0, jenkins-war@2.249, jetty-annotations@9.3.3.v20150827, jetty-webapp@9.3.3.v20150827, junit@4.11, junit@4.12, junit@9.9.9, junit-nonesuch@4.11, main-module@1.0, maven-add-exports-module-flags@1.0-SNAPSHOT, maven-execution-specific-java-version@1.0-SNAPSHOT, maven-java16-with-higher-jdk@1.0-SNAPSHOT, maven-java8-java11-dependency@1.0-SNAPSHOT, maven-multimodule-test-java-version@1.0, maven-sample@1.0-SNAPSHOT, maven-wrapper-missing-properties-test@1.0-SNAPSHOT, maven3-fetch-maven4-wrapper-test@1.0.0, my-app@1.0-SNAPSHOT, otherreleasetest@1.0, snapshottest@1.0-SNAPSHOT, submod1@1.0-SNAPSHOT, submod2@1.0-SNAPSHOT, test-module@1.0, testng@7.7.0, vulnerable-jsp-app@1.0.0-SNAPSHOT, ./.github/actions/install-airbyte-ci@UNKNOWN, file_exclusion@0.1.0

Resolved advisories (35)

Known vulnerabilities (2)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Not counted: 1 match (action reference to a moving tag or branch). Neither identifies a version installed from a registry.

SeverityAdvisoryPackageVersionFixed inOSVReleased binaryKEVEPSSDeclared inDispute
MediumGHSA-6w46-j5rx-g56g source
CVE-2025-71176
pytest
pypi
7.4.49.0.3✓—no0.2%python/extractor/poetry.lockDispute
MediumGHSA-jfmj-5v4g-7637 source
CVE-2024-5569
zipp
pypi
3.15.03.19.1✓—no0.2%python/extractor/poetry.lockDispute

Second opinion: OSV-Scanner

OSV-Scanner found 36 advisories in the same files; 2 of Grype's matches are confirmed by it (marked ✓ above). 34 advisories were reported only by OSV-Scanner.

Reported only by OSV-Scanner (34)
AdvisoryPackageVersionSeverity
RUSTSEC-2021-0153encoding0.2.33Unknown
RUSTSEC-2024-0449unsafe-libyaml0.2.11Unknown
RUSTSEC-2026-0391zstd0.14.2Unknown
RUSTSEC-2026-0395zstd-safe8.1.0Unknown
RUSTSEC-2026-0396zstd-safe8.1.0Unknown
RUSTSEC-2026-0397zstd-safe8.1.0Unknown
RUSTSEC-2026-0398zstd-safe8.1.0Unknown
RUSTSEC-2026-0399zstd-safe8.1.0Unknown
RUSTSEC-2026-0400zstd-safe8.1.0Unknown
RUSTSEC-2026-0401zstd-safe8.1.0Unknown
RUSTSEC-2026-0402zstd-safe8.1.0Unknown
RUSTSEC-2026-0403zstd-safe8.1.0Unknown
RUSTSEC-2026-0404zstd-safe8.1.0Unknown
RUSTSEC-2026-0405zstd-safe8.1.0Unknown
RUSTSEC-2026-0406zstd-safe8.1.0Unknown
RUSTSEC-2026-0410zstd-sys2.1.1+zstd.1.5.7Unknown
RUSTSEC-2026-0190anyhow1.0.95Unknown
RUSTSEC-2026-0204crossbeam-epoch0.9.18Unknown
RUSTSEC-2021-0153encoding0.2.33Unknown
RUSTSEC-2024-0449unsafe-libyaml0.2.11Unknown
RUSTSEC-2026-0391zstd0.13.3Unknown
RUSTSEC-2026-0395zstd-safe7.2.4Unknown
RUSTSEC-2026-0396zstd-safe7.2.4Unknown
RUSTSEC-2026-0397zstd-safe7.2.4Unknown
RUSTSEC-2026-0398zstd-safe7.2.4Unknown
RUSTSEC-2026-0399zstd-safe7.2.4Unknown
RUSTSEC-2026-0400zstd-safe7.2.4Unknown
RUSTSEC-2026-0401zstd-safe7.2.4Unknown
RUSTSEC-2026-0402zstd-safe7.2.4Unknown
RUSTSEC-2026-0403zstd-safe7.2.4Unknown
RUSTSEC-2026-0404zstd-safe7.2.4Unknown
RUSTSEC-2026-0405zstd-safe7.2.4Unknown
RUSTSEC-2026-0406zstd-safe7.2.4Unknown
RUSTSEC-2026-0410zstd-sys2.0.16+zstd.1.5.7Unknown

Repository security (OpenSSF Scorecard)

Score 5.8/10, assessed 2026-10-19 (OpenSSF public dataset). Scorecard viewer

All checks
CheckScoreReason
Binary-Artifacts0binaries present in source code
CII-Best-Practices0no effort to earn an OpenSSF best practices badge detected
Fuzzing0project is not fuzzed
Token-Permissions0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection4branch protection is not maximal on development and all release branches
Code-Review10all changesets reviewed
Dangerous-Workflow10no dangerous workflow patterns detected
License10license file detected
Maintained1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
SAST10SAST tool is run on all commits
Security-Policy10security policy file detected
Packaging—packaging workflow not detected
Signed-Releases—no releases found

GitHub Actions workflow audit (zizmor)

142 potential issues in 45 workflow files at this release: 115 high, 1 medium, 26 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings
SeverityRuleLocationNote
Highunpinned-uses
unpinned action reference
.github/actions/cache-query-compilation/action.yml:26this step
Highunpinned-uses
unpinned action reference
.github/actions/cache-query-compilation/action.yml:38this step
Highunpinned-uses
unpinned action reference
.github/actions/cache-query-compilation/action.yml:56this step
Highunpinned-uses
unpinned action reference
.github/workflows/buildifier.yml:19this step
Highunpinned-uses
unpinned action reference
.github/workflows/check-implicit-this.yml:19this step
Highunpinned-uses
unpinned action reference
.github/workflows/check-overlay-annotations.yml:20this step
Highunpinned-uses
unpinned action reference
.github/workflows/check-qldoc.yml:21this step
Highunpinned-uses
unpinned action reference
.github/workflows/check-query-ids.yml:22this step
Highunpinned-uses
unpinned action reference
.github/workflows/close-stale.yml:18this step
Highunpinned-uses
unpinned action reference
.github/workflows/codeql-analysis.yml:34this step
Highunpinned-uses
unpinned action reference
.github/workflows/codeql-analysis.yml:39this step
Highunpinned-uses
unpinned action reference
.github/workflows/codeql-analysis.yml:43this step
Highunpinned-uses
unpinned action reference
.github/workflows/codeql-analysis.yml:66this step
Highunpinned-uses
unpinned action reference
.github/workflows/cpp-swift-analysis.yml:30this step
Highunpinned-uses
unpinned action reference
.github/workflows/cpp-swift-analysis.yml:34this step
Highunpinned-uses
unpinned action reference
.github/workflows/cpp-swift-analysis.yml:52this step
Highunpinned-uses
unpinned action reference
.github/workflows/csharp-qltest.yml:50this step
Highunpinned-uses
unpinned action reference
.github/workflows/csharp-qltest.yml:51this step
Highunpinned-uses
unpinned action reference
.github/workflows/csharp-qltest.yml:66this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-metrics.yml:25this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-metrics.yml:40this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-metrics.yml:45this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-metrics.yml:53this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-metrics.yml:67this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-metrics.yml:72this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:37this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:41this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:50this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:73this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:80this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:87this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:99this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-artifacts.yml:119this step
Highdangerous-triggers
use of fundamentally insecure workflow trigger
.github/workflows/csv-coverage-pr-comment.yml:3this workflow
Highunsound-condition
unsound conditional expression
.github/workflows/csv-coverage-pr-comment.yml:14this job
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-comment.yml:26this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-pr-comment.yml:28this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-timeseries.yml:14this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-timeseries.yml:18this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-timeseries.yml:23this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-timeseries.yml:32this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-update.yml:23this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage-update.yml:28this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage.yml:18this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage.yml:22this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage.yml:27this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage.yml:36this step
Highunpinned-uses
unpinned action reference
.github/workflows/csv-coverage.yml:41this step
Highunpinned-uses
unpinned action reference
.github/workflows/fast-forward.yml:28this step
Highunpinned-uses
unpinned action reference
.github/workflows/go-tests.yml:28this step
Highunpinned-uses
unpinned action reference
.github/workflows/go-version-update.yml:19this step
Highunpinned-uses
unpinned action reference
.github/workflows/kotlin-build.yml:23this step
Highunpinned-uses
unpinned action reference
.github/workflows/labeler.yml:33this step
Highunpinned-uses
unpinned action reference
.github/workflows/labeler.yml:140this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_modelDiff.yml:30this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_modelDiff.yml:35this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_modelDiff.yml:102this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_modelDiff.yml:107this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_regenerate-models.yml:32this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_regenerate-models.yml:36this step
Highunpinned-uses
unpinned action reference
.github/workflows/mad_regenerate-models.yml:62this step
Highdangerous-triggers
use of fundamentally insecure workflow trigger
.github/workflows/post-pr-comment.yml:6this workflow
Highunpinned-uses
unpinned action reference
.github/workflows/python-tooling.yml:24this step
Highunpinned-uses
unpinned action reference
.github/workflows/python-tooling.yml:25this step
Highunpinned-uses
unpinned action reference
.github/workflows/qhelp-pr-preview.yml:39this step
Highunpinned-uses
unpinned action reference
.github/workflows/qhelp-pr-preview.yml:46this step
Highunpinned-uses
unpinned action reference
.github/workflows/qhelp-pr-preview.yml:80this step
Highunpinned-uses
unpinned action reference
.github/workflows/qhelp-pr-preview.yml:97this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:22this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:25this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:33this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:41this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:72this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:77this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-build.yml:86this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:26this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:28this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:33this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:44this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:64this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:74this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:75this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-dataset_measure.yml:82this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-tests.yml:27this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-tests.yml:28this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-tests.yml:35this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-tests.yml:67this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-tests.yml:73this step
Highunpinned-uses
unpinned action reference
.github/workflows/ql-for-ql-tests.yml:80this step
Highunpinned-uses
unpinned action reference
.github/workflows/query-list.yml:25this step
Highunpinned-uses
unpinned action reference
.github/workflows/query-list.yml:29this step
Highunpinned-uses
unpinned action reference
.github/workflows/query-list.yml:39this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust-analysis.yml:37this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust-analysis.yml:53this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust-analysis.yml:60this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust-analysis.yml:63this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust.yml:35this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust.yml:58this step
Highunpinned-uses
unpinned action reference
.github/workflows/rust.yml:74this step
Highunpinned-uses
unpinned action reference
.github/workflows/swift.yml:43this step
Highunpinned-uses
unpinned action reference
.github/workflows/swift.yml:60this step
Highunpinned-uses
unpinned action reference
.github/workflows/swift.yml:61this step
Highunpinned-uses
unpinned action reference
.github/workflows/swift.yml:71this step
Highunpinned-uses
unpinned action reference
.github/workflows/swift.yml:80this step
Highunpinned-uses
unpinned action reference
.github/workflows/swift.yml:87this step
Highunpinned-uses
unpinned action reference
.github/workflows/sync-files.yml:20this step
Highunpinned-uses
unpinned action reference
.github/workflows/tree-sitter-extractor-test.yml:33this step
Highunpinned-uses
unpinned action reference
.github/workflows/tree-sitter-extractor-test.yml:41this step
Highunpinned-uses
unpinned action reference
.github/workflows/tree-sitter-extractor-test.yml:47this step
Highunpinned-uses
unpinned action reference
.github/workflows/validate-change-notes.yml:25this step
Highunpinned-uses
unpinned action reference
.github/workflows/yeast-test.yml:30this step
Highunpinned-uses
unpinned action reference
.github/workflows/zipmerge-test.yml:21this step
Highunpinned-uses
unpinned action reference
csharp/actions/create-extractor-pack/action.yml:7this step
Highunpinned-uses
unpinned action reference
ruby/actions/create-extractor-pack/action.yml:8this step
Highunpinned-uses
unpinned action reference
ruby/actions/create-extractor-pack/action.yml:14this step
Mediumexcessive-permissions
overly broad permissions
.github/workflows/csv-coverage-metrics.yml:19security-events: write is overly broad at the workflow level
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/check-qldoc.yml:25this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csharp-qltest.yml:67this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csv-coverage-metrics.yml:27this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csv-coverage-metrics.yml:55this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csv-coverage-pr-artifacts.yml:54this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csv-coverage-timeseries.yml:27this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csv-coverage-update.yml:32this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/csv-coverage.yml:31this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/go-tests.yml:30this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/mad_modelDiff.yml:40this step
Lowadhoc-packages
ad-hoc installation of packages
.github/workflows/mad_modelDiff.yml:86this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/mad_regenerate-models.yml:34this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/qhelp-pr-preview.yml:50this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/ql-for-ql-build.yml:31this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/ql-for-ql-build.yml:55this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/ql-for-ql-dataset_measure.yml:32this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/ql-for-ql-tests.yml:34this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/ql-for-ql-tests.yml:49this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/ql-for-ql-tests.yml:79this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/query-list.yml:33this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/rust.yml:76this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/swift.yml:72this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/update-rust-analyzer.lock.yml:465this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/validate-change-notes.yml:28this step
Lowself-repository
use GitHub's dedicated self-repository syntax
csharp/actions/create-extractor-pack/action.yml:6this step
Lowself-repository
use GitHub's dedicated self-repository syntax
ruby/actions/create-extractor-pack/action.yml:7this step

Dependencies (495)

By ecosystem: cargo 410, github 26, unknown 26, pypi 20, golang 8, npm 4, swift 1.

Licenses (as declared in the SBOM): unknown 495.

cargo (410)
NameVersionLicenseDeclared in
adler22.0.0ql/Cargo.lock
adler22.0.1Cargo.lock
aho-corasick1.1.3python/extractor/tsg-python/Cargo.lock
aho-corasick1.1.5Cargo.lock
allocator-api20.2.21Cargo.lock
android_system_properties0.1.5Cargo.lock
anstream0.6.18python/extractor/tsg-python/Cargo.lock
anstream1.0.0Cargo.lock
anstyle1.0.10python/extractor/tsg-python/Cargo.lock
anstyle1.0.14Cargo.lock
anstyle-parse0.2.6python/extractor/tsg-python/Cargo.lock
anstyle-parse1.0.0Cargo.lock
anstyle-query1.1.2python/extractor/tsg-python/Cargo.lock
anstyle-query1.1.5Cargo.lock
anstyle-wincon3.0.11Cargo.lock
anstyle-wincon3.0.6ql/Cargo.lock
anstyle-wincon3.0.7python/extractor/tsg-python/Cargo.lock
anyhow1.0.104Cargo.lock
anyhow1.0.95python/extractor/tsg-python/Cargo.lock
argfile1.0.0Cargo.lock
arrayvec0.7.8Cargo.lock
atomic0.6.1Cargo.lock
autocfg1.4.0ql/Cargo.lock
autocfg1.5.1Cargo.lock
base640.23.1Cargo.lock
bitflags1.3.2Cargo.lock
bitflags2.13.2Cargo.lock
borsh1.8.1Cargo.lock
boxcar0.2.14Cargo.lock
bs580.5.1Cargo.lock
bstr1.10.0ql/Cargo.lock
bstr1.12.1Cargo.lock
bumpalo3.16.0ql/Cargo.lock
bumpalo3.20.3Cargo.lock
bytemuck1.25.0Cargo.lock
bytes1.12.1Cargo.lock
camino1.2.6Cargo.lock
cargo-platform0.3.3Cargo.lock
cargo_metadata0.23.1Cargo.lock
cc1.2.14python/extractor/tsg-python/Cargo.lock
cc1.4.6Cargo.lock
cc1.4.7ql/Cargo.lock
cfg-if1.0.0ql/Cargo.lock
cfg-if1.0.4Cargo.lock
cfg_aliases0.2.2Cargo.lock
chacha200.10.2Cargo.lock
chalk-derive0.104.0Cargo.lock
chalk-ir0.104.0Cargo.lock
chrono0.4.45Cargo.lock
clap4.5.30python/extractor/tsg-python/Cargo.lock
clap4.6.7Cargo.lock
clap_builder4.5.30python/extractor/tsg-python/Cargo.lock
clap_builder4.6.7Cargo.lock
clap_derive4.6.7Cargo.lock
clap_lex0.7.4python/extractor/tsg-python/Cargo.lock
clap_lex1.1.1Cargo.lock
cobs0.3.0Cargo.lock
colorchoice1.0.3python/extractor/tsg-python/Cargo.lock
colorchoice1.0.5Cargo.lock
core-foundation-sys0.8.7Cargo.lock
countme3.0.1Cargo.lock
cov-mark2.2.0Cargo.lock
cpufeatures0.3.1Cargo.lock
crc32fast1.4.2ql/Cargo.lock
crc32fast1.5.0Cargo.lock
crossbeam-channel0.5.17Cargo.lock
crossbeam-deque0.8.5ql/Cargo.lock
crossbeam-deque0.8.8Cargo.lock
crossbeam-epoch0.9.18ql/Cargo.lock
crossbeam-epoch0.9.21Cargo.lock
crossbeam-queue0.3.14Cargo.lock
crossbeam-utils0.8.20ql/Cargo.lock
crossbeam-utils0.8.23Cargo.lock
darling0.24.1Cargo.lock
darling_core0.24.1Cargo.lock
darling_macro0.24.1Cargo.lock
dashmap6.2.1Cargo.lock
defmt1.1.1Cargo.lock
defmt-macros1.1.1Cargo.lock
defmt-parser1.0.0Cargo.lock
deranged0.5.8Cargo.lock
derive-where1.6.1Cargo.lock
dissimilar1.0.11Cargo.lock
drop_bomb0.1.5Cargo.lock
dunce1.0.5Cargo.lock
dyn-clone1.0.20Cargo.lock
either1.13.0ql/Cargo.lock
either1.19.0Cargo.lock
embedded-io0.4.0Cargo.lock
embedded-io0.6.1Cargo.lock
ena0.14.4Cargo.lock
encoding0.2.33Cargo.lock
encoding-index-japanese1.20141219.5Cargo.lock
encoding-index-korean1.20141219.5Cargo.lock
encoding-index-simpchinese1.20141219.5Cargo.lock
encoding-index-singlebyte1.20141219.5Cargo.lock
encoding-index-tradchinese1.20141219.5Cargo.lock
encoding_index_tests0.1.4Cargo.lock
equivalent1.0.2Cargo.lock
figment0.10.19Cargo.lock
find-msvc-tools0.1.12Cargo.lock
find-msvc-tools0.1.13ql/Cargo.lock
fixedbitset0.5.7Cargo.lock
flate21.1.0ql/Cargo.lock
flate21.1.9Cargo.lock
foldhash0.1.5Cargo.lock
foldhash0.2.0Cargo.lock
fs-err3.3.0Cargo.lock
fsevent-sys4.1.0Cargo.lock
fst0.4.7Cargo.lock
futures-core0.3.34Cargo.lock
futures-task0.3.34Cargo.lock
futures-util0.3.34Cargo.lock
getrandom0.4.3Cargo.lock
glob0.3.4Cargo.lock
globset0.4.15ql/Cargo.lock
globset0.4.18Cargo.lock
hashbrown0.12.3Cargo.lock
hashbrown0.14.5Cargo.lock
hashbrown0.15.5Cargo.lock
hashbrown0.17.1Cargo.lock
heck0.5.0Cargo.lock
hermit-abi0.5.2Cargo.lock
hex0.4.3Cargo.lock
iana-time-zone0.1.61ql/Cargo.lock
iana-time-zone0.1.65Cargo.lock
iana-time-zone-haiku0.1.2Cargo.lock
ident_case1.0.1Cargo.lock
indexmap1.9.3Cargo.lock
indexmap2.14.0ql/Cargo.lock
indexmap2.14.2Cargo.lock
inlinable_string0.1.15Cargo.lock
inotify0.11.5Cargo.lock
inotify-sys0.1.8Cargo.lock
intrusive-collections0.10.3Cargo.lock
inventory0.3.24Cargo.lock
is_terminal_polyfill1.70.1python/extractor/tsg-python/Cargo.lock
is_terminal_polyfill1.70.2Cargo.lock
itertools0.15.0Cargo.lock
itoa1.0.11ql/Cargo.lock
itoa1.0.14python/extractor/tsg-python/Cargo.lock
itoa1.0.18Cargo.lock
jiff0.2.37Cargo.lock
jiff-core0.1.1Cargo.lock
jiff-static0.2.37Cargo.lock
jiff-tzdb0.1.8Cargo.lock
jiff-tzdb-platform0.1.3Cargo.lock
jobserver0.1.32ql/Cargo.lock
jobserver0.1.35Cargo.lock
jod-thread1.0.0Cargo.lock
js-sys0.3.103Cargo.lock
js-sys0.3.72ql/Cargo.lock
kqueue1.2.1Cargo.lock
kqueue-sys1.1.2Cargo.lock
la-arena0.3.1Cargo.lock
lazy_static1.5.0ql/Cargo.lock
lazy_static1.5.1Cargo.lock
libc0.2.189Cargo.lock
line-index0.1.2Cargo.lock
lock_api0.4.14Cargo.lock
log0.3.9Cargo.lock
log0.4.22ql/Cargo.lock
log0.4.25python/extractor/tsg-python/Cargo.lock
log0.4.34Cargo.lock
matchers0.2.0Cargo.lock
memchr2.7.4python/extractor/tsg-python/Cargo.lock
memchr2.8.3Cargo.lock
memoffset0.9.1Cargo.lock
miniz_oxide0.8.5ql/Cargo.lock
miniz_oxide0.8.9Cargo.lock
mio1.2.3Cargo.lock
miow0.6.1Cargo.lock
mustache0.9.0Cargo.lock
nohash-hasher0.2.0Cargo.lock
notify8.2.0Cargo.lock
notify-types2.1.0Cargo.lock
nu-ansi-term0.50.3Cargo.lock
num-conv0.2.2Cargo.lock
num-traits0.2.19Cargo.lock
num_cpus1.17.0Cargo.lock
num_threads0.1.7Cargo.lock
once_cell1.20.2ql/Cargo.lock
once_cell1.20.3python/extractor/tsg-python/Cargo.lock
once_cell1.21.4Cargo.lock
once_cell_polyfill1.70.2Cargo.lock
oorandom11.1.5Cargo.lock
os_str_bytes7.2.0Cargo.lock
parking_lot0.12.5Cargo.lock
parking_lot_core0.9.12Cargo.lock
pear0.2.9Cargo.lock
pear_codegen0.2.9Cargo.lock
perf-event0.4.8Cargo.lock
perf-event-open-sys4.0.0Cargo.lock
petgraph0.8.3Cargo.lock
pin-project-lite0.2.15ql/Cargo.lock
pin-project-lite0.2.17Cargo.lock
pkg-config0.3.33ql/Cargo.lock
pkg-config0.3.34Cargo.lock
portable-atomic1.15.0Cargo.lock
portable-atomic-util0.2.7Cargo.lock
postcard1.1.3Cargo.lock
powerfmt0.2.0Cargo.lock
proc-macro21.0.107Cargo.lock
proc-macro21.0.93python/extractor/tsg-python/Cargo.lock
proc-macro2-diagnostics0.10.1Cargo.lock
quote1.0.38python/extractor/tsg-python/Cargo.lock
quote1.0.45ql/Cargo.lock
quote1.0.47Cargo.lock
r-efi6.0.0Cargo.lock
ra-ap-rustc_abi0.166.0Cargo.lock
ra-ap-rustc_ast_ir0.166.0Cargo.lock
ra-ap-rustc_hashes0.166.0Cargo.lock
ra-ap-rustc_index0.166.0Cargo.lock
ra-ap-rustc_index_macros0.166.0Cargo.lock
ra-ap-rustc_lexer0.166.0Cargo.lock
ra-ap-rustc_next_trait_solver0.166.0Cargo.lock
ra-ap-rustc_parse_format0.166.0Cargo.lock
ra-ap-rustc_pattern_analysis0.166.0Cargo.lock
ra-ap-rustc_type_ir0.166.0Cargo.lock
ra-ap-rustc_type_ir_macros0.166.0Cargo.lock
ra_ap_base_db0.0.358Cargo.lock
ra_ap_cfg0.0.358Cargo.lock
ra_ap_edition0.0.358Cargo.lock
ra_ap_hir0.0.358Cargo.lock
ra_ap_hir_def0.0.358Cargo.lock
ra_ap_hir_expand0.0.358Cargo.lock
ra_ap_hir_ty0.0.358Cargo.lock
ra_ap_ide_db0.0.358Cargo.lock
ra_ap_intern0.0.358Cargo.lock
ra_ap_load-cargo0.0.358Cargo.lock
ra_ap_macros0.0.358Cargo.lock
ra_ap_mbe0.0.358Cargo.lock
ra_ap_parser0.0.358Cargo.lock
ra_ap_paths0.0.358Cargo.lock
ra_ap_proc_macro_api0.0.358Cargo.lock
ra_ap_profile0.0.358Cargo.lock
ra_ap_project_model0.0.358Cargo.lock
ra_ap_span0.0.358Cargo.lock
ra_ap_stdx0.0.358Cargo.lock
ra_ap_syntax0.0.358Cargo.lock
ra_ap_syntax-bridge0.0.358Cargo.lock
ra_ap_test_fixture0.0.358Cargo.lock
ra_ap_test_utils0.0.358Cargo.lock
ra_ap_toolchain0.0.358Cargo.lock
ra_ap_tt0.0.358Cargo.lock
ra_ap_vfs0.0.358Cargo.lock
ra_ap_vfs-notify0.0.358Cargo.lock
rand0.10.3Cargo.lock
rand_core0.10.1Cargo.lock
rayon1.12.0Cargo.lock
rayon-core1.13.0Cargo.lock
redox_syscall0.5.18Cargo.lock
ref-cast1.0.26Cargo.lock
ref-cast-impl1.0.26Cargo.lock
regex1.11.1python/extractor/tsg-python/Cargo.lock
regex1.13.1Cargo.lock
regex-automata0.4.18Cargo.lock
regex-automata0.4.9python/extractor/tsg-python/Cargo.lock
regex-syntax0.8.11Cargo.lock
regex-syntax0.8.5python/extractor/tsg-python/Cargo.lock
rowan0.17.0Cargo.lock
rustc-hash1.1.0Cargo.lock
rustc-hash2.1.3Cargo.lock
rustc-literal-escaper0.0.7Cargo.lock
rustc-stable-hash0.1.2Cargo.lock
rustc_apfloat0.2.3+llvm-462a31f5a5abCargo.lock
rustversion1.0.23Cargo.lock
ryu1.0.18ql/Cargo.lock
ryu1.0.19python/extractor/tsg-python/Cargo.lock
ryu1.0.23Cargo.lock
salsa0.28.5Cargo.lock
salsa-macro-rules0.28.5Cargo.lock
salsa-macros0.28.5Cargo.lock
same-file1.0.6Cargo.lock
schemars0.9.0Cargo.lock
schemars1.2.2Cargo.lock
scopeguard1.2.0Cargo.lock
semver1.0.28Cargo.lock
serde1.0.217python/extractor/tsg-python/Cargo.lock
serde1.0.229Cargo.lock
serde_core1.0.229Cargo.lock
serde_derive1.0.217python/extractor/tsg-python/Cargo.lock
serde_derive1.0.229Cargo.lock
serde_json1.0.138python/extractor/tsg-python/Cargo.lock
serde_json1.0.151ql/Cargo.lock
serde_json1.0.154Cargo.lock
serde_spanned1.1.2Cargo.lock
serde_with3.24.0Cargo.lock
serde_with_macros3.24.0Cargo.lock
serde_yaml0.9.34+deprecatedCargo.lock
sharded-slab0.1.7Cargo.lock
shlex1.3.0python/extractor/tsg-python/Cargo.lock
shlex2.0.1Cargo.lock
simd-adler320.3.9Cargo.lock
slab0.4.12Cargo.lock
smallvec1.13.2ql/Cargo.lock
smallvec1.14.0python/extractor/tsg-python/Cargo.lock
smallvec1.16.1Cargo.lock
smol_str0.3.6Cargo.lock
stable_deref_trait1.2.1Cargo.lock
streaming-iterator0.1.9Cargo.lock
strsim0.11.1Cargo.lock
syn2.0.119Cargo.lock
syn2.0.87ql/Cargo.lock
syn2.0.98python/extractor/tsg-python/Cargo.lock
syn3.0.6ql/Cargo.lock
syn3.0.9Cargo.lock
synstructure0.13.2Cargo.lock
text-size1.1.1Cargo.lock
thin-vec0.2.19Cargo.lock
thiserror1.0.69python/extractor/tsg-python/Cargo.lock
thiserror2.0.20Cargo.lock
thiserror-impl1.0.69python/extractor/tsg-python/Cargo.lock
thiserror-impl2.0.20Cargo.lock
thread_local1.1.10Cargo.lock
thread_local1.1.8ql/Cargo.lock
time0.3.55Cargo.lock
time-core0.1.9Cargo.lock
time-macros0.2.32Cargo.lock
tinyvec1.13.3Cargo.lock
toml1.1.8+spec-1.1.0Cargo.lock
toml_datetime1.1.2+spec-1.1.0Cargo.lock
toml_parser1.1.5+spec-1.1.0Cargo.lock
toml_writer1.1.3+spec-1.1.0Cargo.lock
tracing0.1.44Cargo.lock
tracing-attributes0.1.31Cargo.lock
tracing-core0.1.36Cargo.lock
tracing-flame0.2.0Cargo.lock
tracing-log0.2.0Cargo.lock
tracing-subscriber0.3.23Cargo.lock
tracing-tree0.4.1Cargo.lock
tree-sitter0.24.7python/extractor/tsg-python/Cargo.lock
tree-sitter0.26.13ql/Cargo.lock
tree-sitter0.26.9Cargo.lock
tree-sitter-embedded-template0.25.0Cargo.lock
tree-sitter-graph0.12.0python/extractor/tsg-python/Cargo.lock
tree-sitter-json0.23.0ql/Cargo.lock
tree-sitter-json0.24.8Cargo.lock
tree-sitter-language0.1.2ql/Cargo.lock
tree-sitter-language0.1.5python/extractor/tsg-python/Cargo.lock
tree-sitter-language0.1.7Cargo.lock
tree-sitter-python0.25.0Cargo.lock
tree-sitter-ql0.23.1Cargo.lock
tree-sitter-ql-dbscheme0.23.0ql/Cargo.lock
tree-sitter-ruby0.23.1Cargo.lock
triomphe0.1.17Cargo.lock
typed-arena2.0.2Cargo.lock
typeid1.0.3Cargo.lock
uncased0.9.10Cargo.lock
ungrammar1.16.1Cargo.lock
unicode-ident1.0.13ql/Cargo.lock
unicode-ident1.0.16python/extractor/tsg-python/Cargo.lock
unicode-ident1.0.24Cargo.lock
unicode-properties0.1.4Cargo.lock
unsafe-libyaml0.2.11Cargo.lock
utf8parse0.2.2Cargo.lock
valuable0.1.0ql/Cargo.lock
valuable0.1.1Cargo.lock
version_check0.9.5Cargo.lock
walkdir2.5.0Cargo.lock
wasi0.11.1+wasi-snapshot-preview1Cargo.lock
wasm-bindgen0.2.126Cargo.lock
wasm-bindgen0.2.95ql/Cargo.lock
wasm-bindgen-backend0.2.95ql/Cargo.lock
wasm-bindgen-macro0.2.126Cargo.lock
wasm-bindgen-macro0.2.95ql/Cargo.lock
wasm-bindgen-macro-support0.2.126Cargo.lock
wasm-bindgen-macro-support0.2.95ql/Cargo.lock
wasm-bindgen-shared0.2.126Cargo.lock
wasm-bindgen-shared0.2.95ql/Cargo.lock
winapi-util0.1.11Cargo.lock
windows-core0.52.0ql/Cargo.lock
windows-core0.62.2Cargo.lock
windows-implement0.60.2Cargo.lock
windows-interface0.59.3Cargo.lock
windows-result0.4.1Cargo.lock
windows-strings0.5.1Cargo.lock
windows-sys0.59.0python/extractor/tsg-python/Cargo.lock
windows-sys0.60.2Cargo.lock
windows-sys0.61.2Cargo.lock
windows-targets0.52.6python/extractor/tsg-python/Cargo.lock
windows-targets0.53.5Cargo.lock
windows_aarch64_gnullvm0.52.6python/extractor/tsg-python/Cargo.lock
windows_aarch64_gnullvm0.53.1Cargo.lock
windows_aarch64_msvc0.52.6python/extractor/tsg-python/Cargo.lock
windows_aarch64_msvc0.53.1Cargo.lock
windows_i686_gnu0.52.6python/extractor/tsg-python/Cargo.lock
windows_i686_gnu0.53.1Cargo.lock
windows_i686_gnullvm0.52.6python/extractor/tsg-python/Cargo.lock
windows_i686_gnullvm0.53.1Cargo.lock
windows_i686_msvc0.52.6python/extractor/tsg-python/Cargo.lock
windows_i686_msvc0.53.1Cargo.lock
windows_x86_64_gnu0.52.6python/extractor/tsg-python/Cargo.lock
windows_x86_64_gnu0.53.1Cargo.lock
windows_x86_64_gnullvm0.52.6python/extractor/tsg-python/Cargo.lock
windows_x86_64_gnullvm0.53.1Cargo.lock
windows_x86_64_msvc0.52.6python/extractor/tsg-python/Cargo.lock
windows_x86_64_msvc0.53.1Cargo.lock
winnow0.7.13Cargo.lock
winnow1.0.4Cargo.lock
yansi1.0.1Cargo.lock
zmij1.0.23Cargo.lock
zstd0.13.3ql/Cargo.lock
zstd0.14.2Cargo.lock
zstd-safe7.2.4ql/Cargo.lock
zstd-safe8.1.0Cargo.lock
zstd-sys2.0.16+zstd.1.5.7ql/Cargo.lock
zstd-sys2.1.1+zstd.1.5.7Cargo.lock
github (26)
NameVersionLicenseDeclared in
actions/cachev3.github/actions/cache-query-compilation/action.yml
actions/cache/restorev3.github/actions/cache-query-compilation/action.yml
actions/cache/restorev6.1.0.github/workflows/update-rust-analyzer.lock.yml
actions/cache/savev6.1.0.github/workflows/update-rust-analyzer.lock.yml
actions/checkoutv5.github/workflows/buildifier.yml
actions/checkoutv7.0.1.github/workflows/update-rust-analyzer.lock.yml
actions/create-github-app-tokenv3.2.0.github/workflows/label-external-contributions.yml
actions/download-artifactv4.github/workflows/ql-for-ql-dataset_measure.yml
actions/download-artifactv8.0.1.github/workflows/update-rust-analyzer.lock.yml
actions/github-scriptv6.github/actions/cache-query-compilation/action.yml
actions/github-scriptv9.0.0.github/workflows/update-rust-analyzer.lock.yml
actions/labelerv4.github/workflows/labeler.yml
actions/setup-dotnetv4.github/workflows/codeql-analysis.yml
actions/setup-nodev7.0.0.github/workflows/update-rust-analyzer.lock.yml
actions/setup-pythonv4.github/workflows/csv-coverage-pr-artifacts.yml
actions/setup-pythonv5.github/workflows/python-tooling.yml
actions/stalev9.github/workflows/close-stale.yml
actions/upload-artifactv4.github/workflows/csv-coverage-metrics.yml
actions/upload-artifactv7.0.1.github/workflows/update-rust-analyzer.lock.yml
github/codeql-action/analyzemain.github/workflows/codeql-analysis.yml
github/codeql-action/autobuildmain.github/workflows/rust-analysis.yml
github/codeql-action/initmain.github/workflows/codeql-analysis.yml
github/codeql-action/setup-codeqlmain.github/workflows/ql-for-ql-build.yml
github/codeql-action/upload-sarifmain.github/workflows/csv-coverage-metrics.yml
github/gh-aw-actions/setupv0.88.7.github/workflows/update-rust-analyzer.lock.yml
pre-commit/action646c83fcd040023954eafda54b4db0192ce70507.github/workflows/buildifier.yml
unknown (26)
NameVersionLicenseDeclared in
./.github/actions/cache-query-compilationUNKNOWN.github/workflows/ql-for-ql-build.yml
./.github/actions/fetch-codeqlUNKNOWN.github/workflows/check-qldoc.yml
./.github/actions/os-versionUNKNOWN.github/workflows/ql-for-ql-build.yml
./codeql-main/.github/actions/fetch-codeqlUNKNOWN.github/workflows/mad_modelDiff.yml
./codeql/.github/actions/fetch-codeqlUNKNOWN.github/workflows/query-list.yml
./csharp/actions/create-extractor-packUNKNOWN.github/workflows/csharp-qltest.yml
./go/actions/testUNKNOWN.github/workflows/go-tests.yml
./merge/.github/actions/fetch-codeqlUNKNOWN.github/workflows/csv-coverage-pr-artifacts.yml
./ql/.github/actions/fetch-codeqlUNKNOWN.github/workflows/csv-coverage-update.yml
./script/.github/actions/fetch-codeqlUNKNOWN.github/workflows/csv-coverage-timeseries.yml
ast-generator0.1.0Cargo.lock
buramu0.1.0ql/Cargo.lock
codeql-autobuilder-rust0.1.0Cargo.lock
codeql-extractor0.2.0Cargo.lock
codeql-extractor-ql0.1.0ql/Cargo.lock
codeql-extractor-ruby0.1.0Cargo.lock
codeql-extractor-unified0.1.0Cargo.lock
codeql-rust0.1.0Cargo.lock
rust-extractor-macros0.1.0Cargo.lock
swift-syntax-rs0.1.0Cargo.lock
tree-sitter-blame0.0.1ql/Cargo.lock
tsg-python0.1.0python/extractor/tsg-python/Cargo.lock
tsp0.19.0python/extractor/tsg-python/Cargo.lock
yeast0.1.0Cargo.lock
yeast-macros0.1.0Cargo.lock
yeast-schema0.1.0Cargo.lock
pypi (20)
NameVersionLicenseDeclared in
colorama0.4.6python/extractor/poetry.lock
exceptiongroup1.2.2python/extractor/poetry.lock
importlib-metadata6.7.0python/extractor/poetry.lock
inflection0.5.1misc/codegen/requirements_lock.txt
iniconfig2.0.0misc/codegen/requirements_lock.txt
packaging23.2python/extractor/poetry.lock
packaging24.2misc/codegen/requirements_lock.txt
pluggy1.2.0python/extractor/poetry.lock
pluggy1.5.0misc/codegen/requirements_lock.txt
pygments2.20.0misc/codegen/requirements_lock.txt
pystache0.6.8misc/codegen/requirements_lock.txt
pytest7.4.4python/extractor/poetry.lock
pytest9.1.1misc/codegen/requirements_lock.txt
pytest-mock3.11.1python/extractor/poetry.lock
pyyaml6.0.1python/extractor/poetry.lock
pyyaml6.0.2misc/codegen/requirements_lock.txt
tomli2.0.1python/extractor/poetry.lock
toposort1.10misc/codegen/requirements_lock.txt
typing-extensions4.7.1python/extractor/poetry.lock
zipp3.15.0python/extractor/poetry.lock
golang (8)
NameVersionLicenseDeclared in
github.com/davecgh/go-spewv1.1.1go/extractor/go.mod
github.com/pmezard/go-difflibv1.0.0go/extractor/go.mod
github.com/stretchr/testifyv1.11.1go/extractor/go.mod
golang.org/x/modv0.42.0go/extractor/go.mod
golang.org/x/syncv0.24.0go/extractor/go.mod
golang.org/x/sysv0.49.0go/extractor/go.mod
golang.org/x/toolsv0.52.0go/extractor/go.mod
gopkg.in/yaml.v3v3.0.1go/extractor/go.mod
npm (4)
NameVersionLicenseDeclared in
@types/node24.3.1javascript/extractor/lib/typescript/package-lock.json
typescript5.9.2javascript/extractor/lib/typescript/package-lock.json
typescript-parser-wrapperUNKNOWNjavascript/extractor/lib/typescript/package-lock.json
undici-types7.10.0javascript/extractor/lib/typescript/package-lock.json
swift (1)
NameVersionLicenseDeclared in
swift-syntax603.0.2unified/swift-syntax-rs/schemagen/Package.resolved

History

WeekVersionDependenciesCriticalHighMediumLowUnknownChanges
2026-11-02main49500200+2 · −49 · 35 resolved
2026-11-01main5432213014—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

StandardScoreChecks passedFailed checks
NTIA 2021715/7Supplier Name, Dependency Relationship
CISA 2025505/10Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183444/9Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report · sbomlyze diff from last week

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/github__codeql/.

94 manifests and lockfiles scanned

.github/actions/cache-query-compilation/action.yml, .github/actions/fetch-codeql/action.yml, .github/actions/os-version/action.yml, .github/workflows/buildifier.yml, .github/workflows/check-change-note.yml, .github/workflows/check-implicit-this.yml, .github/workflows/check-overlay-annotations.yml, .github/workflows/check-qldoc.yml, .github/workflows/check-query-ids.yml, .github/workflows/close-stale.yml, .github/workflows/codeql-analysis.yml, .github/workflows/cpp-swift-analysis.yml, .github/workflows/csharp-qltest.yml, .github/workflows/csv-coverage-metrics.yml, .github/workflows/csv-coverage-pr-artifacts.yml, .github/workflows/csv-coverage-pr-comment.yml, .github/workflows/csv-coverage-timeseries.yml, .github/workflows/csv-coverage-update.yml, .github/workflows/csv-coverage.yml, .github/workflows/fast-forward.yml, .github/workflows/go-tests.yml, .github/workflows/go-version-update.yml, .github/workflows/kotlin-build.yml, .github/workflows/label-external-contributions.yml, .github/workflows/labeler.yml, .github/workflows/mad_modelDiff.yml, .github/workflows/mad_regenerate-models.yml, .github/workflows/post-pr-comment.yml, .github/workflows/python-tooling.yml, .github/workflows/qhelp-pr-preview.yml, .github/workflows/ql-for-ql-build.yml, .github/workflows/ql-for-ql-dataset_measure.yml, .github/workflows/ql-for-ql-tests.yml, .github/workflows/query-list.yml, .github/workflows/rust-analysis.yml, .github/workflows/rust.yml, .github/workflows/swift.yml, .github/workflows/sync-files.yml, .github/workflows/tree-sitter-extractor-test.yml, .github/workflows/update-rust-analyzer.lock.yml, .github/workflows/validate-change-notes.yml, .github/workflows/yeast-test.yml, .github/workflows/zipmerge-test.yml, Cargo.lock, Cargo.toml, csharp/actions/create-extractor-pack/action.yml, csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj, csharp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj, csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj, csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/Semmle.Extraction.CSharp.DependencyFetching.csproj, csharp/extractor/Semmle.Extraction.CSharp.DependencyStubGenerator/Semmle.Extraction.CSharp.DependencyStubGenerator.csproj, csharp/extractor/Semmle.Extraction.CSharp.Driver/Semmle.Extraction.CSharp.Driver.csproj, csharp/extractor/Semmle.Extraction.CSharp.Standalone/Semmle.Extraction.CSharp.Standalone.csproj, csharp/extractor/Semmle.Extraction.CSharp.StubGenerator/Semmle.Extraction.CSharp.StubGenerator.csproj, csharp/extractor/Semmle.Extraction.CSharp.Util/Semmle.Extraction.CSharp.Util.csproj, csharp/extractor/Semmle.Extraction.CSharp/Semmle.Extraction.CSharp.csproj, csharp/extractor/Semmle.Util/Semmle.Util.csproj, go/extractor/go.mod, go/extractor/go.sum, java/kotlin-extractor/build.gradle, javascript/extractor/lib/typescript/package-lock.json, javascript/extractor/lib/typescript/package.json, misc/codegen/requirements_in.txt, misc/codegen/requirements_lock.txt, python/extractor/poetry.lock, python/extractor/pyproject.toml, python/extractor/setup.py, python/extractor/tsg-python/Cargo.lock, python/extractor/tsg-python/Cargo.toml, python/extractor/tsg-python/tsp/Cargo.toml, python/extractor/tsg-python/tsp/package.json, python/tools/recorded-call-graph-metrics/requirements.txt, python/tools/recorded-call-graph-metrics/setup.py, ql/Cargo.lock, ql/Cargo.toml, ql/buramu/Cargo.toml, ql/buramu/tree-sitter-blame/Cargo.toml, ql/buramu/tree-sitter-blame/package.json, ql/extractor/Cargo.toml, ruby/actions/create-extractor-pack/action.yml, ruby/extractor/Cargo.toml, rust/ast-generator/Cargo.toml, rust/autobuild/Cargo.toml, rust/extractor/Cargo.toml, rust/extractor/macros/Cargo.toml, shared/tree-sitter-extractor/Cargo.toml, shared/yeast-macros/Cargo.toml, shared/yeast-schema/Cargo.toml, shared/yeast/Cargo.toml, unified/extractor-unsupported-os/Cargo.toml, unified/extractor/Cargo.toml, unified/swift-syntax-rs/Cargo.toml, unified/swift-syntax-rs/schemagen/Package.resolved, unified/swift-syntax-rs/swift/Package.resolved

Full JSON for this project · Atom feed of weekly changes

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

How the weekly supply-chain report is producedEvery Sunday the catalog's tools are resolved to their latest release. Manifests and workflows go to Syft, Grype, OSV-Scanner, sbomlyze, and zizmor; the release binary and its signatures go to govulncheck, Cosign, slsa-verifier, and GitHub attestation verification; the repository goes to OpenSSF Scorecard. Results are compared with the previous week and published here.Catalog78 tools in READMELatest releaseGitHub API, every SundayManifests & workflowssparse checkout, no testsRelease binaryLinux amd64 + signaturesRepositoryGitHub & OpenSSF dataSyftSBOMGrype + OSV-Scannerknown advisoriessbomlyzediff + minimum elementszizmorworkflow auditgovulncheckvulnerable code in binaryCosign · slsa-verifier · ghrelease verificationOpenSSF Scorecardrepository practicesCompare with last weekdata branch historyThis reportoverview + project pages
ToolWhat it does hereVersion this week
SyftGenerates a CycloneDX SBOM from each release's manifests and lockfiles.1.55.0
GrypeMatches the SBOM against known vulnerabilities.0.121.0
OSV-ScannerChecks the same files against the OSV database to confirm or add matches.2.7.0
govulncheckFor Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.1.9.0
zizmorAudits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.1.31.1
OpenSSF ScorecardScores repository security practices such as code review, branch protection, and pinned dependencies.5.6.0
CosignVerifies Sigstore signatures on the release binary or its checksums file.3.1.4
slsa-verifierVerifies SLSA build provenance published with the release.2.7.1
GitHub CLI attestationsVerifies GitHub artifact attestations for the release binary.—
sbomlyzeDiffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.0.6.0