cartography

Map infrastructure relationships and attack surface

lyft/cartography · Cloud Security · scanned 0.144.0 (released 2026-10-29) · commit 66ead780c590 · last scan 2026-11-02

262

declared dependencies

0 / 6

critical / high advisories

advisories with a fixed version

8.1

OpenSSF Scorecard (of 10); OpenSSF public dataset

no release files

release verification

Changes since last week

no change.

Known vulnerabilities (22)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Severity	Advisory	Package	Version	Fixed in	OSV	Released binary	KEV	EPSS	Declared in	Dispute
High	`GHSA-v4x8-3wr5-3wq8` source CVE-2026-112940	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.2%	`uv.lock`	Dispute
High	`GHSA-2qm8-x737-gmw5` source CVE-2026-119196	`pyasn1` pypi	`0.6.4`	0.6.5	✓	—	no	0.4%	`uv.lock`	Dispute
High	`GHSA-9m75-vc3g-4x39` source CVE-2026-119195	`pyasn1` pypi	`0.6.4`	0.6.5	✓	—	no	0.5%	`uv.lock`	Dispute
High	`GHSA-fm9c-5rcf-2q5p` source CVE-2026-119194	`pyasn1` pypi	`0.6.4`	0.6.5	✓	—	no	0.4%	`uv.lock`	Dispute
High	`GHSA-mm57-4v3p-rchx` source CVE-2026-119197	`pyasn1` pypi	`0.6.4`	0.6.5	✓	—	no	0.4%	`uv.lock`	Dispute
High	`GHSA-cx6f-vjhg-g3cc` source CVE-2026-115586	`virtualenv` pypi	`21.14.9`	21.14.13	✓	—	no	0.3%	`uv.lock`	Dispute
Medium	`GHSA-6627-m3xw-93mp` source CVE-2026-112908	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	—	`uv.lock`	Dispute
Medium	`GHSA-69hj-f68j-2879` source CVE-2026-112909	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.2%	`uv.lock`	Dispute
Medium	`GHSA-8mx5-7m5m-r77g` source CVE-2026-112910	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	—	`uv.lock`	Dispute
Medium	`GHSA-9c4x-gm8v-wgc4` source CVE-2026-112911	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.1%	`uv.lock`	Dispute
Medium	`GHSA-cwqr-hh33-gh44` source CVE-2026-112915	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.2%	`uv.lock`	Dispute
Medium	`GHSA-fq56-3cx3-fjxp` source CVE-2026-112935	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.1%	`uv.lock`	Dispute
Medium	`GHSA-j8f7-rjxc-mr56` source CVE-2026-112936	`filelock` pypi	`3.32.7`	4.0.9	✓	—	no	0.2%	`uv.lock`	Dispute
Medium	`GHSA-m462-7rxw-wvpg` source CVE-2026-112938	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	—	`uv.lock`	Dispute
Medium	`GHSA-rfpc-qcw5-3pc4` source CVE-2026-112939	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.1%	`uv.lock`	Dispute
Medium	`GHSA-h35f-9h28-mq5c` source CVE-2026-59890	`setuptools` pypi	`80.10.2`	83.0.0	✓	—	no	0.4%	`uv.lock`	Dispute
Medium	`GHSA-4f8h-vr72-p32c` source CVE-2026-113713	`virtualenv` pypi	`21.14.9`	21.14.10	✓	—	no	0.2%	`uv.lock`	Dispute
Low	`GHSA-567q-5qvw-pf92` source CVE-2026-112907	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	—	`uv.lock`	Dispute
Low	`GHSA-9j6q-wvj5-jgjg` source CVE-2026-112912	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	0.2%	`uv.lock`	Dispute
Low	`GHSA-9vhv-jxww-xfm5` source CVE-2026-112913	`filelock` pypi	`3.32.7`	4.2.1	✓	—	no	—	`uv.lock`	Dispute
Low	`GHSA-5239-wwwm-4pmq` source CVE-2026-4539	`pygments` pypi	`2.19.2`	2.20.0	✓	—	no	0.2%	`uv.lock`	Dispute
Low	`GHSA-xmj3-9gf7-h52w` source	`setuptools` pypi	`80.10.2`	84.1.0	✓	—	no	—	`uv.lock`	Dispute

Second opinion: OSV-Scanner

OSV-Scanner found 22 advisories in the same files; 22 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Release integrity

Verdict: no release files.

Checksums file: no
Signatures: no
SLSA provenance: no
SBOM published with the release: no

Verified means a signature, provenance, or attestation was checked against an identity in lyft/cartography's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 8.1/10, assessed 2026-10-26 (OpenSSF public dataset). Scorecard viewer

All checks

Check	Score	Reason
CII-Best-Practices	0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	0	project is not fuzzed
SAST	0	SAST tool is not run on all commits -- score normalized to 0
Code-Review	9	Found 21/22 approved changesets -- score normalized to 9
Binary-Artifacts	10	no binaries found in the repo
Dangerous-Workflow	10	no dangerous workflow patterns detected
License	10	license file detected
Maintained	10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging	10	packaging workflow detected
Pinned-Dependencies	10	all dependencies are pinned
Security-Policy	10	security policy file detected
Token-Permissions	10	GitHub workflow tokens follow principle of least privilege
Branch-Protection	—	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	—	no releases found

GitHub Actions workflow audit (zizmor)

1 potential issues in 6 workflow files at this release: 0 high, 0 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings

Severity	Rule	Location	Note
Informational	use-trusted-publishing prefer trusted publishing for authentication	`.github/workflows/publish-to-ghcr-and-pypi.yml:59`	this step

Dependencies (262)

By ecosystem: pypi 246, github 16.

Licenses (as declared in the SBOM): unknown 262.

pypi (246)

Name	Version	Declared in
`adal`	`1.2.7`	`uv.lock`
`aenum`	`3.1.17`	`uv.lock`
`aioboto3`	`15.5.0`	`uv.lock`
`aiobotocore`	`2.25.1`	`uv.lock`
`aiofiles`	`25.1.0`	`uv.lock`
`aiohappyeyeballs`	`2.6.1`	`uv.lock`
`aiohttp`	`3.14.4`	`uv.lock`
`aioitertools`	`0.13.0`	`uv.lock`
`aiosignal`	`1.4.0`	`uv.lock`
`alabaster`	`1.0.0`	`uv.lock`
`annotated-doc`	`0.0.4`	`uv.lock`
`annotated-types`	`0.7.0`	`uv.lock`
`anyio`	`4.14.2`	`uv.lock`
`asn1crypto`	`1.5.1`	`uv.lock`
`attrs`	`25.4.0`	`uv.lock`
`azure-common`	`1.1.28`	`uv.lock`
`azure-core`	`1.39.0`	`uv.lock`
`azure-identity`	`1.26.0`	`uv.lock`
`azure-keyvault-certificates`	`4.11.3`	`uv.lock`
`azure-keyvault-keys`	`4.11.3`	`uv.lock`
`azure-keyvault-secrets`	`4.11.3`	`uv.lock`
`azure-mgmt-authorization`	`4.0.0`	`uv.lock`
`azure-mgmt-compute`	`38.4.0`	`uv.lock`
`azure-mgmt-containerinstance`	`10.1.0`	`uv.lock`
`azure-mgmt-containerservice`	`41.7.0`	`uv.lock`
`azure-mgmt-core`	`1.6.0`	`uv.lock`
`azure-mgmt-cosmosdb`	`10.0.0`	`uv.lock`
`azure-mgmt-datafactory`	`10.0.0`	`uv.lock`
`azure-mgmt-eventgrid`	`10.4.0`	`uv.lock`
`azure-mgmt-eventhub`	`12.0.0`	`uv.lock`
`azure-mgmt-keyvault`	`14.1.0`	`uv.lock`
`azure-mgmt-logic`	`10.0.0`	`uv.lock`
`azure-mgmt-managementgroups`	`2.0.0`	`uv.lock`
`azure-mgmt-monitor`	`7.0.0`	`uv.lock`
`azure-mgmt-network`	`33.0.0`	`uv.lock`
`azure-mgmt-resource`	`26.0.0`	`uv.lock`
`azure-mgmt-resource-subscriptions`	`1.0.0`	`uv.lock`
`azure-mgmt-security`	`7.0.0`	`uv.lock`
`azure-mgmt-sql`	`4.0.0`	`uv.lock`
`azure-mgmt-storage`	`25.2.0`	`uv.lock`
`azure-mgmt-synapse`	`2.0.0`	`uv.lock`
`azure-mgmt-web`	`11.0.1`	`uv.lock`
`azure-storage-blob`	`12.31.0`	`uv.lock`
`azure-synapse-artifacts`	`0.22.0`	`uv.lock`
`babel`	`2.18.0`	`uv.lock`
`backoff`	`2.2.1`	`uv.lock`
`black`	`26.10.1`	`uv.lock`
`blinker`	`1.9.0`	`uv.lock`
`boto3`	`1.40.61`	`uv.lock`
`botocore`	`1.40.61`	`uv.lock`
`cartography`	`UNKNOWN`	`uv.lock`
`cbor2`	`6.1.3`	`uv.lock`
`certifi`	`2026.10.19`	`uv.lock`
`cffi`	`2.0.0`	`uv.lock`
`cfgv`	`3.5.0`	`uv.lock`
`charset-normalizer`	`3.4.4`	`uv.lock`
`circuitbreaker`	`2.1.3`	`uv.lock`
`click`	`8.3.1`	`uv.lock`
`cloudflare`	`5.9.0`	`uv.lock`
`colorama`	`0.4.6`	`uv.lock`
`coverage`	`7.13.3`	`uv.lock`
`crc32c`	`2.8`	`uv.lock`
`crowdstrike-falconpy`	`1.6.6`	`uv.lock`
`cryptography`	`50.0.2`	`uv.lock`
`distlib`	`0.4.4`	`uv.lock`
`distro`	`1.9.0`	`uv.lock`
`dnspython`	`2.9.0`	`uv.lock`
`docker`	`7.1.0`	`uv.lock`
`docstring-parser`	`0.18.0`	`uv.lock`
`docutils`	`0.22.4`	`uv.lock`
`duo-client`	`5.7.0`	`uv.lock`
`durationpy`	`0.10`	`uv.lock`
`execnet`	`2.1.2`	`uv.lock`
`filelock`	`3.32.7`	`uv.lock`
`frozenlist`	`1.8.0`	`uv.lock`
`google-api-core`	`2.42.0`	`uv.lock`
`google-api-python-client`	`2.201.0`	`uv.lock`
`google-auth`	`2.62.0`	`uv.lock`
`google-auth-httplib2`	`0.3.0`	`uv.lock`
`google-cloud-access-context-manager`	`0.3.0`	`uv.lock`
`google-cloud-aiplatform`	`2.5.0`	`uv.lock`
`google-cloud-artifact-registry`	`1.23.0`	`uv.lock`
`google-cloud-asset`	`4.5.0`	`uv.lock`
`google-cloud-bigquery`	`3.41.0`	`uv.lock`
`google-cloud-core`	`2.5.1`	`uv.lock`
`google-cloud-org-policy`	`1.16.0`	`uv.lock`
`google-cloud-os-config`	`1.23.0`	`uv.lock`
`google-cloud-resource-manager`	`1.19.0`	`uv.lock`
`google-cloud-run`	`0.16.2`	`uv.lock`
`google-cloud-storage`	`3.17.1`	`uv.lock`
`google-crc32c`	`1.8.0`	`uv.lock`
`google-genai`	`1.73.1`	`uv.lock`
`google-resumable-media`	`2.8.2`	`uv.lock`
`googleapis-common-protos`	`1.72.0`	`uv.lock`
`grpc-google-iam-v1`	`0.14.3`	`uv.lock`
`grpcio`	`1.76.0`	`uv.lock`
`grpcio-status`	`1.76.0`	`uv.lock`
`grpclib`	`0.4.9`	`uv.lock`
`h11`	`0.16.0`	`uv.lock`
`h2`	`4.4.1`	`uv.lock`
`hpack`	`4.2.0`	`uv.lock`
`httpcore`	`1.0.9`	`uv.lock`
`httpcore2`	`2.13.1`	`uv.lock`
`httplib2`	`0.32.0`	`uv.lock`
`httpx`	`0.28.1`	`uv.lock`
`httpx2`	`2.13.1`	`uv.lock`
`httpx2-jsfetch`	`1.0`	`uv.lock`
`hyperframe`	`6.1.0`	`uv.lock`
`identify`	`2.6.16`	`uv.lock`
`idna`	`3.19`	`uv.lock`
`imagesize`	`1.4.1`	`uv.lock`
`iniconfig`	`2.3.0`	`uv.lock`
`isodate`	`0.7.2`	`uv.lock`
`jinja2`	`3.1.6`	`uv.lock`
`jmespath`	`1.1.0`	`uv.lock`
`jwcrypto`	`1.5.9`	`uv.lock`
`kubernetes`	`36.0.3`	`uv.lock`
`linkify-it-py`	`2.0.3`	`uv.lock`
`markdown-it-py`	`4.0.0`	`uv.lock`
`markupsafe`	`3.0.3`	`uv.lock`
`marshmallow`	`4.3.1`	`uv.lock`
`mdit-py-plugins`	`0.5.0`	`uv.lock`
`mdurl`	`0.1.2`	`uv.lock`
`microsoft-kiota-abstractions`	`1.11.7`	`uv.lock`
`microsoft-kiota-authentication-azure`	`1.11.7`	`uv.lock`
`microsoft-kiota-http`	`1.11.7`	`uv.lock`
`microsoft-kiota-serialization-form`	`1.11.7`	`uv.lock`
`microsoft-kiota-serialization-json`	`1.11.7`	`uv.lock`
`microsoft-kiota-serialization-multipart`	`1.11.7`	`uv.lock`
`microsoft-kiota-serialization-text`	`1.11.7`	`uv.lock`
`modal`	`1.6.2`	`uv.lock`
`moto`	`5.2.4`	`uv.lock`
`msal`	`1.39.0`	`uv.lock`
`msal-extensions`	`1.3.1`	`uv.lock`
`msgraph-core`	`1.5.1`	`uv.lock`
`msgraph-sdk`	`1.64.0`	`uv.lock`
`msrest`	`0.7.1`	`uv.lock`
`msrestazure`	`0.6.4.post1`	`uv.lock`
`multidict`	`6.9.1`	`uv.lock`
`mypy-extensions`	`1.1.0`	`uv.lock`
`myst-parser`	`5.0.0`	`uv.lock`
`neo4j`	`6.4.1`	`uv.lock`
`neo4j-rust-ext`	`6.4.1.0`	`uv.lock`
`nodeenv`	`1.10.0`	`uv.lock`
`oauthlib`	`4.0.0`	`uv.lock`
`oci`	`2.188.0`	`uv.lock`
`okta`	`3.4.4`	`uv.lock`
`opentelemetry-api`	`1.45.1`	`uv.lock`
`opentelemetry-sdk`	`1.45.1`	`uv.lock`
`opentelemetry-semantic-conventions`	`0.66b1`	`uv.lock`
`packageurl-python`	`0.17.6`	`uv.lock`
`packaging`	`26.3`	`uv.lock`
`pagerduty`	`7.0.1`	`uv.lock`
`pathspec`	`1.0.4`	`uv.lock`
`platformdirs`	`4.5.1`	`uv.lock`
`pluggy`	`1.6.0`	`uv.lock`
`policyuniverse`	`1.5.1.20231109`	`uv.lock`
`pre-commit`	`4.7.0`	`uv.lock`
`propcache`	`0.4.1`	`uv.lock`
`proto-plus`	`1.27.1`	`uv.lock`
`protobuf`	`6.33.5`	`uv.lock`
`pyasn1`	`0.6.4`	`uv.lock`
`pyasn1-modules`	`0.4.2`	`uv.lock`
`pycparser`	`3.0`	`uv.lock`
`pycryptodomex`	`3.23.0`	`uv.lock`
`pydantic`	`2.12.5`	`uv.lock`
`pydantic-core`	`2.41.5`	`uv.lock`
`pydash`	`8.1.0`	`uv.lock`
`pydo`	`0.44.0`	`uv.lock`
`pygments`	`2.19.2`	`uv.lock`
`pygments-styles`	`0.3.0`	`uv.lock`
`pyjwt`	`2.15.0`	`uv.lock`
`pyopenssl`	`26.4.0`	`uv.lock`
`pyparsing`	`3.3.2`	`uv.lock`
`pytest`	`9.1.1`	`uv.lock`
`pytest-asyncio`	`1.4.0`	`uv.lock`
`pytest-cov`	`7.1.0`	`uv.lock`
`pytest-mock`	`3.16.1`	`uv.lock`
`pytest-rerunfailures`	`16.7`	`uv.lock`
`pytest-xdist`	`3.8.0`	`uv.lock`
`python-dateutil`	`2.9.0.post0`	`uv.lock`
`python-discovery`	`1.6.1`	`uv.lock`
`python-dotenv`	`1.2.2`	`uv.lock`
`python-pkcs11`	`0.9.4`	`uv.lock`
`pytokens`	`0.4.1`	`uv.lock`
`pytz`	`2025.2`	`uv.lock`
`pywin32`	`311`	`uv.lock`
`pyyaml`	`6.0.3`	`uv.lock`
`requests`	`2.34.2`	`uv.lock`
`requests-oauthlib`	`2.0.0`	`uv.lock`
`responses`	`0.25.8`	`uv.lock`
`rich`	`14.3.2`	`uv.lock`
`roman-numerals`	`4.1.0`	`uv.lock`
`s3transfer`	`0.14.0`	`uv.lock`
`scaleway`	`2.12.0`	`uv.lock`
`scaleway-core`	`2.12.0`	`uv.lock`
`setuptools`	`80.10.2`	`uv.lock`
`shellingham`	`1.5.4`	`uv.lock`
`shibuya`	`2026.7.12`	`uv.lock`
`six`	`1.17.0`	`uv.lock`
`slack-sdk`	`3.45.0`	`uv.lock`
`sniffio`	`1.3.1`	`uv.lock`
`snowballstemmer`	`3.0.1`	`uv.lock`
`sphinx`	`9.0.4`	`uv.lock`
`sphinx`	`9.1.0`	`uv.lock`
`sphinx-autobuild`	`2025.8.25`	`uv.lock`
`sphinx-copybutton`	`0.5.2`	`uv.lock`
`sphinx-last-updated-by-git`	`0.3.8`	`uv.lock`
`sphinx-sitemap`	`2.9.0`	`uv.lock`
`sphinxcontrib-applehelp`	`2.0.0`	`uv.lock`
`sphinxcontrib-devhelp`	`2.0.0`	`uv.lock`
`sphinxcontrib-htmlhelp`	`2.1.0`	`uv.lock`
`sphinxcontrib-jsmath`	`1.0.1`	`uv.lock`
`sphinxcontrib-mermaid`	`2.1.1`	`uv.lock`
`sphinxcontrib-qthelp`	`2.0.0`	`uv.lock`
`sphinxcontrib-serializinghtml`	`2.0.0`	`uv.lock`
`starlette`	`1.3.1`	`uv.lock`
`statsd`	`4.0.1`	`uv.lock`
`std-uritemplate`	`2.0.8`	`uv.lock`
`synchronicity`	`0.12.6`	`uv.lock`
`tenacity`	`9.1.4`	`uv.lock`
`testcontainers`	`4.15.0`	`uv.lock`
`toml`	`0.10.2`	`uv.lock`
`tomli`	`2.4.0`	`uv.lock`
`truststore`	`0.10.4`	`uv.lock`
`typer`	`0.27.3`	`uv.lock`
`types-aiobotocore-ecr`	`3.9.2`	`uv.lock`
`types-certifi`	`2021.10.8.3`	`uv.lock`
`types-pyyaml`	`6.0.12.20260906`	`uv.lock`
`types-requests`	`2.33.0.20261006`	`uv.lock`
`types-toml`	`0.10.8.20260518`	`uv.lock`
`typing-extensions`	`4.15.0`	`uv.lock`
`typing-inspection`	`0.4.2`	`uv.lock`
`uc-micro-py`	`1.0.3`	`uv.lock`
`uritemplate`	`4.2.0`	`uv.lock`
`urllib3`	`2.8.0`	`uv.lock`
`uvicorn`	`0.40.0`	`uv.lock`
`virtualenv`	`21.14.9`	`uv.lock`
`watchfiles`	`1.1.1`	`uv.lock`
`websocket-client`	`1.9.0`	`uv.lock`
`websockets`	`16.0`	`uv.lock`
`werkzeug`	`3.1.9`	`uv.lock`
`workos`	`10.5.0`	`uv.lock`
`wrapt`	`1.17.3`	`uv.lock`
`xmltodict`	`1.0.4`	`uv.lock`
`yarl`	`1.25.1`	`uv.lock`

github (16)

Name	Version	Declared in
`actions/checkout`	`v7.0.1`	`.github/workflows/ossf-scorecard.yml`
`actions/download-artifact`	`v8.0.2`	`.github/workflows/sphinx.yml`
`actions/setup-python`	`v7.0.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`actions/stale`	`v11.0.0`	`.github/workflows/stale.yml`
`actions/upload-artifact`	`v7.0.2`	`.github/workflows/ossf-scorecard.yml`
`astral-sh/setup-uv`	`v10.3.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`docker/build-push-action`	`v7.4.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`docker/login-action`	`v4.6.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`docker/metadata-action`	`v6.2.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`docker/setup-buildx-action`	`v4.4.1`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`docker/setup-docker-action`	`v5.5.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`docker/setup-qemu-action`	`v4.4.0`	`.github/workflows/publish-to-ghcr-and-pypi.yml`
`github/codeql-action/upload-sarif`	`v3.29.5`	`.github/workflows/ossf-scorecard.yml`
`ossf/scorecard-action`	`v2.5.0`	`.github/workflows/ossf-scorecard.yml`
`peaceiris/actions-gh-pages`	`v4.1.0`	`.github/workflows/sphinx.yml`
`pre-commit/action`	`v3.0.1`	`.github/workflows/test_suite.yml`

History

Week	Version	Dependencies	Critical	High	Medium	Low	Unknown	Changes
2026-11-02	0.144.0	262	0	6	11	5	0	—
2026-11-01	0.144.0	262	0	6	11	5	0	—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Standard	Score	Checks passed	Failed checks
NTIA 2021	71	5/7	Supplier Name, Dependency Relationship
CISA 2025	50	5/10	Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183	44	4/9	Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/lyft__cartography/.

10 manifests and lockfiles scanned

.github/workflows/ossf-scorecard.yml, .github/workflows/publish-to-ghcr-and-pypi.yml, .github/workflows/refresh_shard_durations.yml, .github/workflows/sphinx.yml, .github/workflows/stale.yml, .github/workflows/test_suite.yml, pyproject.toml, setup.cfg, setup.py, uv.lock

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Flyft%2Fcartography%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/lyft/cartography/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

Tool	What it does here	Version this week
Syft	Generates a CycloneDX SBOM from each release's manifests and lockfiles.	1.55.0
Grype	Matches the SBOM against known vulnerabilities.	0.121.0
OSV-Scanner	Checks the same files against the OSV database to confirm or add matches.	2.7.0
govulncheck	For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.	1.9.0
zizmor	Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.	1.31.1
OpenSSF Scorecard	Scores repository security practices such as code review, branch protection, and pinned dependencies.	5.6.0
Cosign	Verifies Sigstore signatures on the release binary or its checksums file.	3.1.4
slsa-verifier	Verifies SLSA build provenance published with the release.	2.7.1
GitHub CLI attestations	Verifies GitHub artifact attestations for the release binary.	—
sbomlyze	Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.	0.6.0