zizmor

Analyze GitHub Actions workflows for security issues

zizmorcore/zizmor · Infrastructure as Code Security · scanned v1.31.1 (released 2026-10-15) · commit effdb35fa786 · last scan 2026-11-02

494

declared dependencies

0 / 0

critical / high advisories

advisories with a fixed version

—

OpenSSF Scorecard (of 10); no result this week

verified

release verification

Changes since last week

no change.

Known vulnerabilities (4)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Severity	Advisory	Package	Version	Fixed in	OSV	Released binary	KEV	EPSS	Declared in	Dispute
Medium	`GHSA-2mjx-qc3c-rqvc` source	`rustls` cargo	`0.23.34`	0.23.45	✓	—	no	—	`Cargo.lock`	Dispute
Medium	`GHSA-c8m5-c952-6cm4` source	`rustls` cargo	`0.23.34`	0.23.46	✓	—	no	—	`Cargo.lock`	Dispute
Low	`GHSA-h2v8-394m-p7vv` source	`rustls` cargo	`0.23.34`	0.23.46	✓	—	no	—	`Cargo.lock`	Dispute
Low	`GHSA-w44r-93j7-qv28` source	`rustls` cargo	`0.23.34`	0.23.46	✓	—	no	—	`Cargo.lock`	Dispute

Second opinion: OSV-Scanner

OSV-Scanner found 15 advisories in the same files; 4 of Grype's matches are confirmed by it (marked ✓ above). 11 advisories were reported only by OSV-Scanner.

Reported only by OSV-Scanner (11)

Advisory	Package	Version	Severity
`RUSTSEC-2026-0204`	`crossbeam-epoch`	`0.9.18`	Unknown
`GHSA-q83h-524g-xf6h, RUSTSEC-2026-0258`	`h2`	`0.4.13`	Unknown
`RUSTSEC-2026-0186`	`memmap2`	`0.5.10`	Unknown
`GHSA-465w-v9q3-7j98, RUSTSEC-2026-0338`	`quinn-proto`	`0.11.16`	Unknown
`GHSA-hmxj-32vh-65vr, RUSTSEC-2026-0339`	`quinn-proto`	`0.11.16`	Unknown
`GHSA-3g6h-r5qx-f6hq, RUSTSEC-2026-0340`	`quinn-proto`	`0.11.16`	High
`GHSA-qfwj-vfxf-92j2, RUSTSEC-2026-0341`	`quinn-proto`	`0.11.16`	High
`GHSA-2hv7-gw8g-gpq5, RUSTSEC-2026-0342`	`quinn-proto`	`0.11.16`	Unknown
`BIT-golang-2026-111943, CVE-2026-111943, GO-2026-6809`	`rustls-webpki`	`0.103.13`	Unknown
`RUSTSEC-2026-0386`	`tokio`	`1.53.2`	Unknown
`BIT-golang-2026-111943, CVE-2026-111943, GO-2026-6809`	`webpki-root-certs`	`1.0.5`	Unknown

Release integrity

Verdict: verified for zizmor-x86_64-unknown-linux-gnu.tar.gz. The download matches GitHub's recorded digest.

Checksums file: no
Signatures: no
SLSA provenance: no
SBOM published with the release: no

Check	Result	Detail
GitHub build attestation	verified	https://slsa.dev/provenance/v1
GitHub immutable release	verified	GitHub attests the file is unchanged since the release was published

Verified means a signature, provenance, or attestation was checked against an identity in zizmorcore/zizmor's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

No Scorecard result yet (the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used). Results are added as the weekly budget allows.

GitHub Actions workflow audit (zizmor)

No medium- or high-confidence issues in 11 workflow files.

Dependencies (494)

By ecosystem: cargo 441, pypi 22, github 21, unknown 10.

Licenses (as declared in the SBOM): unknown 494.

cargo (441)

Name	Version	Declared in
`addr2line`	`0.25.1`	`Cargo.lock`
`adler2`	`2.0.1`	`Cargo.lock`
`ahash`	`0.8.12`	`Cargo.lock`
`aho-corasick`	`1.1.3`	`Cargo.lock`
`allocator-api2`	`0.2.21`	`Cargo.lock`
`annotate-snippets`	`0.12.16`	`Cargo.lock`
`anstream`	`1.0.0`	`Cargo.lock`
`anstyle`	`1.0.14`	`Cargo.lock`
`anstyle-parse`	`1.0.0`	`Cargo.lock`
`anstyle-query`	`1.1.4`	`Cargo.lock`
`anstyle-wincon`	`3.0.10`	`Cargo.lock`
`anyhow`	`1.0.104`	`Cargo.lock`
`arrayvec`	`0.7.6`	`Cargo.lock`
`assert_cmd`	`2.2.2`	`Cargo.lock`
`async-lock`	`3.4.2`	`Cargo.lock`
`async-trait`	`0.1.92`	`Cargo.lock`
`atomic-waker`	`1.1.2`	`Cargo.lock`
`autocfg`	`1.5.0`	`Cargo.lock`
`aws-lc-rs`	`1.17.0`	`Cargo.lock`
`aws-lc-sys`	`0.41.0`	`Cargo.lock`
`backtrace`	`0.3.76`	`Cargo.lock`
`base64`	`0.21.7`	`Cargo.lock`
`base64`	`0.22.1`	`Cargo.lock`
`base64`	`0.23.1`	`Cargo.lock`
`bit-set`	`0.8.0`	`Cargo.lock`
`bit-vec`	`0.8.0`	`Cargo.lock`
`bitflags`	`2.10.0`	`Cargo.lock`
`bitflip`	`0.1.0`	`Cargo.lock`
`block-buffer`	`0.10.4`	`Cargo.lock`
`borrow-or-share`	`0.2.4`	`Cargo.lock`
`bstr`	`1.12.0`	`Cargo.lock`
`bumpalo`	`3.19.0`	`Cargo.lock`
`bytecount`	`0.6.9`	`Cargo.lock`
`bytes`	`1.11.1`	`Cargo.lock`
`cacache`	`13.1.0`	`Cargo.lock`
`camino`	`1.2.6`	`Cargo.lock`
`cc`	`1.4.6`	`Cargo.lock`
`cesu8`	`1.1.0`	`Cargo.lock`
`cfg-if`	`1.0.4`	`Cargo.lock`
`cfg_aliases`	`0.2.1`	`Cargo.lock`
`chacha20`	`0.10.1`	`Cargo.lock`
`clap`	`4.6.7`	`Cargo.lock`
`clap-verbosity-flag`	`3.0.4`	`Cargo.lock`
`clap_builder`	`4.6.7`	`Cargo.lock`
`clap_complete`	`4.6.11`	`Cargo.lock`
`clap_complete_nushell`	`4.6.2`	`Cargo.lock`
`clap_derive`	`4.6.7`	`Cargo.lock`
`clap_lex`	`1.0.0`	`Cargo.lock`
`cmake`	`0.1.54`	`Cargo.lock`
`cobs`	`0.3.0`	`Cargo.lock`
`colorchoice`	`1.0.4`	`Cargo.lock`
`combine`	`4.6.7`	`Cargo.lock`
`console`	`0.16.4`	`Cargo.lock`
`core-foundation`	`0.10.1`	`Cargo.lock`
`core-foundation`	`0.9.4`	`Cargo.lock`
`core-foundation-sys`	`0.8.7`	`Cargo.lock`
`cpufeatures`	`0.2.17`	`Cargo.lock`
`cpufeatures`	`0.3.0`	`Cargo.lock`
`crossbeam-channel`	`0.5.16`	`Cargo.lock`
`crossbeam-deque`	`0.8.6`	`Cargo.lock`
`crossbeam-epoch`	`0.9.18`	`Cargo.lock`
`crossbeam-utils`	`0.8.21`	`Cargo.lock`
`crypto-common`	`0.1.7`	`Cargo.lock`
`csv`	`1.4.0`	`Cargo.lock`
`csv-core`	`0.1.13`	`Cargo.lock`
`dashmap`	`6.1.0`	`Cargo.lock`
`data-encoding`	`2.9.0`	`Cargo.lock`
`deranged`	`0.5.4`	`Cargo.lock`
`difflib`	`0.4.0`	`Cargo.lock`
`digest`	`0.10.7`	`Cargo.lock`
`displaydoc`	`0.2.5`	`Cargo.lock`
`dunce`	`1.0.5`	`Cargo.lock`
`dyn-clone`	`1.0.20`	`Cargo.lock`
`either`	`1.16.0`	`Cargo.lock`
`email_address`	`0.2.9`	`Cargo.lock`
`embedded-io`	`0.4.0`	`Cargo.lock`
`embedded-io`	`0.6.1`	`Cargo.lock`
`encode_unicode`	`1.0.0`	`Cargo.lock`
`encoding_rs`	`0.8.35`	`Cargo.lock`
`equivalent`	`1.0.2`	`Cargo.lock`
`errno`	`0.3.14`	`Cargo.lock`
`etcetera`	`0.11.0`	`Cargo.lock`
`event-listener`	`5.4.2`	`Cargo.lock`
`event-listener-strategy`	`0.5.4`	`Cargo.lock`
`fancy-regex`	`0.19.0`	`Cargo.lock`
`fastrand`	`2.3.0`	`Cargo.lock`
`filetime`	`0.2.26`	`Cargo.lock`
`find-msvc-tools`	`0.1.12`	`Cargo.lock`
`flate2`	`1.1.10`	`Cargo.lock`
`fluent-uri`	`0.3.2`	`Cargo.lock`
`fluent-uri`	`0.4.1`	`Cargo.lock`
`fnv`	`1.0.7`	`Cargo.lock`
`foldhash`	`0.1.5`	`Cargo.lock`
`foldhash`	`0.2.0`	`Cargo.lock`
`form_urlencoded`	`1.2.2`	`Cargo.lock`
`fraction`	`0.17.0`	`Cargo.lock`
`fs_extra`	`1.3.0`	`Cargo.lock`
`fst`	`0.4.7`	`Cargo.lock`
`futures`	`0.3.34`	`Cargo.lock`
`futures-channel`	`0.3.34`	`Cargo.lock`
`futures-core`	`0.3.34`	`Cargo.lock`
`futures-executor`	`0.3.34`	`Cargo.lock`
`futures-io`	`0.3.34`	`Cargo.lock`
`futures-macro`	`0.3.34`	`Cargo.lock`
`futures-sink`	`0.3.34`	`Cargo.lock`
`futures-task`	`0.3.34`	`Cargo.lock`
`futures-util`	`0.3.34`	`Cargo.lock`
`generic-array`	`0.14.7`	`Cargo.lock`
`getrandom`	`0.2.16`	`Cargo.lock`
`getrandom`	`0.3.4`	`Cargo.lock`
`getrandom`	`0.4.2`	`Cargo.lock`
`gimli`	`0.32.3`	`Cargo.lock`
`globset`	`0.4.18`	`Cargo.lock`
`h2`	`0.4.13`	`Cargo.lock`
`hashbrown`	`0.14.5`	`Cargo.lock`
`hashbrown`	`0.15.5`	`Cargo.lock`
`hashbrown`	`0.17.0`	`Cargo.lock`
`heck`	`0.5.0`	`Cargo.lock`
`hex`	`0.4.3`	`Cargo.lock`
`http`	`1.5.0`	`Cargo.lock`
`http-body`	`1.0.1`	`Cargo.lock`
`http-body-util`	`0.1.3`	`Cargo.lock`
`http-cache`	`1.0.0-alpha.8`	`Cargo.lock`
`http-cache-reqwest`	`1.0.0-alpha.9`	`Cargo.lock`
`http-cache-semantics`	`3.0.0`	`Cargo.lock`
`http-serde`	`2.1.1`	`Cargo.lock`
`httparse`	`1.10.1`	`Cargo.lock`
`httpdate`	`1.0.3`	`Cargo.lock`
`human-panic`	`2.0.8`	`Cargo.lock`
`hyper`	`1.7.0`	`Cargo.lock`
`hyper-rustls`	`0.27.7`	`Cargo.lock`
`hyper-util`	`0.1.17`	`Cargo.lock`
`icu_collections`	`2.0.0`	`Cargo.lock`
`icu_locale_core`	`2.0.0`	`Cargo.lock`
`icu_normalizer`	`2.0.0`	`Cargo.lock`
`icu_normalizer_data`	`2.0.0`	`Cargo.lock`
`icu_properties`	`2.0.1`	`Cargo.lock`
`icu_properties_data`	`2.0.1`	`Cargo.lock`
`icu_provider`	`2.0.0`	`Cargo.lock`
`id-arena`	`2.3.0`	`Cargo.lock`
`idna`	`1.1.0`	`Cargo.lock`
`idna_adapter`	`1.2.1`	`Cargo.lock`
`ignore`	`0.4.33`	`Cargo.lock`
`indexmap`	`2.14.2`	`Cargo.lock`
`indicatif`	`0.18.6`	`Cargo.lock`
`insta`	`1.49.0`	`Cargo.lock`
`ipnet`	`2.11.0`	`Cargo.lock`
`iri-string`	`0.7.8`	`Cargo.lock`
`is_terminal_polyfill`	`1.70.2`	`Cargo.lock`
`itertools`	`0.14.0`	`Cargo.lock`
`itertools`	`0.15.0`	`Cargo.lock`
`itoa`	`1.0.15`	`Cargo.lock`
`jni`	`0.21.1`	`Cargo.lock`
`jni-sys`	`0.3.0`	`Cargo.lock`
`jobserver`	`0.1.34`	`Cargo.lock`
`js-sys`	`0.3.85`	`Cargo.lock`
`jsonschema`	`0.58.5`	`Cargo.lock`
`jsonschema-regex`	`0.58.5`	`Cargo.lock`
`jsonschema-value`	`0.58.5`	`Cargo.lock`
`lazy_static`	`1.5.0`	`Cargo.lock`
`leb128fmt`	`0.1.0`	`Cargo.lock`
`libc`	`0.2.185`	`Cargo.lock`
`libredox`	`0.1.10`	`Cargo.lock`
`libyaml-rs`	`0.3.0`	`Cargo.lock`
`line-index`	`0.1.2`	`Cargo.lock`
`linux-raw-sys`	`0.12.1`	`Cargo.lock`
`litemap`	`0.8.0`	`Cargo.lock`
`lock_api`	`0.4.14`	`Cargo.lock`
`log`	`0.4.28`	`Cargo.lock`
`lru-slab`	`0.1.2`	`Cargo.lock`
`ls-types`	`0.0.2`	`Cargo.lock`
`matchers`	`0.2.0`	`Cargo.lock`
`memchr`	`2.8.3`	`Cargo.lock`
`memmap2`	`0.5.10`	`Cargo.lock`
`micromap`	`0.3.0`	`Cargo.lock`
`miette`	`5.10.0`	`Cargo.lock`
`miette-derive`	`5.10.0`	`Cargo.lock`
`mime`	`0.3.17`	`Cargo.lock`
`miniz_oxide`	`0.8.9`	`Cargo.lock`
`mio`	`1.2.0`	`Cargo.lock`
`moka`	`0.12.15`	`Cargo.lock`
`nohash-hasher`	`0.2.0`	`Cargo.lock`
`ntapi`	`0.4.2`	`Cargo.lock`
`nu-ansi-term`	`0.50.3`	`Cargo.lock`
`num`	`0.4.3`	`Cargo.lock`
`num-bigint`	`0.4.8`	`Cargo.lock`
`num-cmp`	`0.1.0`	`Cargo.lock`
`num-complex`	`0.4.6`	`Cargo.lock`
`num-conv`	`0.2.0`	`Cargo.lock`
`num-integer`	`0.1.46`	`Cargo.lock`
`num-iter`	`0.1.45`	`Cargo.lock`
`num-rational`	`0.4.2`	`Cargo.lock`
`num-traits`	`0.2.19`	`Cargo.lock`
`objc2-core-foundation`	`0.3.2`	`Cargo.lock`
`objc2-io-kit`	`0.3.2`	`Cargo.lock`
`object`	`0.37.3`	`Cargo.lock`
`once_cell`	`1.21.3`	`Cargo.lock`
`once_cell_polyfill`	`1.70.2`	`Cargo.lock`
`openssl-probe`	`0.1.6`	`Cargo.lock`
`outref`	`0.5.2`	`Cargo.lock`
`owo-colors`	`4.4.0`	`Cargo.lock`
`parking`	`2.2.1`	`Cargo.lock`
`parking_lot`	`0.12.5`	`Cargo.lock`
`parking_lot_core`	`0.9.12`	`Cargo.lock`
`percent-encoding`	`2.3.2`	`Cargo.lock`
`pin-project-lite`	`0.2.16`	`Cargo.lock`
`pin-utils`	`0.1.0`	`Cargo.lock`
`portable-atomic`	`1.13.1`	`Cargo.lock`
`postcard`	`1.1.3`	`Cargo.lock`
`potential_utf`	`0.1.3`	`Cargo.lock`
`powerfmt`	`0.2.0`	`Cargo.lock`
`predicates`	`3.1.3`	`Cargo.lock`
`predicates-core`	`1.0.9`	`Cargo.lock`
`predicates-tree`	`1.0.12`	`Cargo.lock`
`prettyplease`	`0.2.37`	`Cargo.lock`
`proc-macro2`	`1.0.106`	`Cargo.lock`
`quinn`	`0.11.9`	`Cargo.lock`
`quinn-proto`	`0.11.16`	`Cargo.lock`
`quinn-udp`	`0.5.14`	`Cargo.lock`
`quote`	`1.0.45`	`Cargo.lock`
`r-efi`	`5.3.0`	`Cargo.lock`
`r-efi`	`6.0.0`	`Cargo.lock`
`rand`	`0.10.2`	`Cargo.lock`
`rand_core`	`0.10.1`	`Cargo.lock`
`rand_pcg`	`0.10.2`	`Cargo.lock`
`redox_syscall`	`0.5.18`	`Cargo.lock`
`ref-cast`	`1.0.25`	`Cargo.lock`
`ref-cast-impl`	`1.0.25`	`Cargo.lock`
`referencing`	`0.58.5`	`Cargo.lock`
`reflink-copy`	`0.1.30`	`Cargo.lock`
`regex`	`1.13.1`	`Cargo.lock`
`regex-automata`	`0.4.18`	`Cargo.lock`
`regex-syntax`	`0.8.11`	`Cargo.lock`
`reqwest`	`0.13.5`	`Cargo.lock`
`reqwest-middleware`	`0.5.2`	`Cargo.lock`
`ring`	`0.17.14`	`Cargo.lock`
`rustc-demangle`	`0.1.26`	`Cargo.lock`
`rustc-hash`	`2.1.1`	`Cargo.lock`
`rustix`	`1.1.4`	`Cargo.lock`
`rustls`	`0.23.34`	`Cargo.lock`
`rustls-native-certs`	`0.8.1`	`Cargo.lock`
`rustls-pki-types`	`1.12.0`	`Cargo.lock`
`rustls-platform-verifier`	`0.6.1`	`Cargo.lock`
`rustls-platform-verifier-android`	`0.1.1`	`Cargo.lock`
`rustls-webpki`	`0.103.13`	`Cargo.lock`
`rustversion`	`1.0.22`	`Cargo.lock`
`ryu`	`1.0.20`	`Cargo.lock`
`same-file`	`1.0.6`	`Cargo.lock`
`schannel`	`0.1.27`	`Cargo.lock`
`schemars`	`1.2.2`	`Cargo.lock`
`schemars_derive`	`1.2.2`	`Cargo.lock`
`scopeguard`	`1.2.0`	`Cargo.lock`
`security-framework`	`3.3.0`	`Cargo.lock`
`security-framework-sys`	`2.14.0`	`Cargo.lock`
`self_cell`	`1.3.0`	`Cargo.lock`
`semver`	`1.0.27`	`Cargo.lock`
`serde`	`1.0.229`	`Cargo.lock`
`serde_core`	`1.0.229`	`Cargo.lock`
`serde_derive`	`1.0.229`	`Cargo.lock`
`serde_derive_internals`	`0.30.0`	`Cargo.lock`
`serde_json`	`1.0.151`	`Cargo.lock`
`serde_spanned`	`1.1.1`	`Cargo.lock`
`serde_urlencoded`	`0.7.1`	`Cargo.lock`
`sha-1`	`0.10.1`	`Cargo.lock`
`sha1`	`0.10.7`	`Cargo.lock`
`sha2`	`0.10.9`	`Cargo.lock`
`sharded-slab`	`0.1.7`	`Cargo.lock`
`shlex`	`2.0.1`	`Cargo.lock`
`similar`	`2.7.0`	`Cargo.lock`
`similar`	`3.2.0`	`Cargo.lock`
`slab`	`0.4.11`	`Cargo.lock`
`smallvec`	`1.15.1`	`Cargo.lock`
`socket2`	`0.6.3`	`Cargo.lock`
`ssri`	`9.2.0`	`Cargo.lock`
`stable_deref_trait`	`1.2.1`	`Cargo.lock`
`streaming-iterator`	`0.1.9`	`Cargo.lock`
`strsim`	`0.11.1`	`Cargo.lock`
`strum`	`0.28.0`	`Cargo.lock`
`strum_macros`	`0.28.0`	`Cargo.lock`
`subtle`	`2.6.1`	`Cargo.lock`
`syn`	`2.0.117`	`Cargo.lock`
`syn`	`3.0.3`	`Cargo.lock`
`sync_wrapper`	`1.0.2`	`Cargo.lock`
`synstructure`	`0.13.2`	`Cargo.lock`
`sysinfo`	`0.38.4`	`Cargo.lock`
`system-configuration`	`0.6.1`	`Cargo.lock`
`system-configuration-sys`	`0.6.0`	`Cargo.lock`
`tagptr`	`0.2.0`	`Cargo.lock`
`tar`	`0.4.46`	`Cargo.lock`
`tempfile`	`3.27.0`	`Cargo.lock`
`terminal-link`	`0.1.0`	`Cargo.lock`
`termtree`	`0.5.1`	`Cargo.lock`
`text-size`	`1.1.1`	`Cargo.lock`
`thiserror`	`1.0.69`	`Cargo.lock`
`thiserror`	`2.0.21`	`Cargo.lock`
`thiserror-impl`	`1.0.69`	`Cargo.lock`
`thiserror-impl`	`2.0.21`	`Cargo.lock`
`thread_local`	`1.1.9`	`Cargo.lock`
`tikv-jemalloc-sys`	`0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8`	`Cargo.lock`
`tikv-jemallocator`	`0.7.0`	`Cargo.lock`
`time`	`0.3.47`	`Cargo.lock`
`time-core`	`0.1.8`	`Cargo.lock`
`time-macros`	`0.2.27`	`Cargo.lock`
`tinystr`	`0.8.1`	`Cargo.lock`
`tinyvec`	`1.10.0`	`Cargo.lock`
`tinyvec_macros`	`0.1.1`	`Cargo.lock`
`tokio`	`1.53.2`	`Cargo.lock`
`tokio-macros`	`2.7.2`	`Cargo.lock`
`tokio-rustls`	`0.26.4`	`Cargo.lock`
`tokio-stream`	`0.1.19`	`Cargo.lock`
`tokio-util`	`0.7.16`	`Cargo.lock`
`toml`	`1.1.1+spec-1.1.0`	`Cargo.lock`
`toml_datetime`	`1.1.1+spec-1.1.0`	`Cargo.lock`
`toml_writer`	`1.1.1+spec-1.1.0`	`Cargo.lock`
`tower`	`0.5.2`	`Cargo.lock`
`tower-http`	`0.6.8`	`Cargo.lock`
`tower-layer`	`0.3.3`	`Cargo.lock`
`tower-lsp-server`	`0.23.0`	`Cargo.lock`
`tower-service`	`0.3.3`	`Cargo.lock`
`tracing`	`0.1.44`	`Cargo.lock`
`tracing-attributes`	`0.1.31`	`Cargo.lock`
`tracing-core`	`0.1.36`	`Cargo.lock`
`tracing-indicatif`	`0.3.14`	`Cargo.lock`
`tracing-log`	`0.2.0`	`Cargo.lock`
`tracing-subscriber`	`0.3.23`	`Cargo.lock`
`tree-sitter`	`0.27.0`	`Cargo.lock`
`tree-sitter-bash`	`0.25.1`	`Cargo.lock`
`tree-sitter-language`	`0.1.8`	`Cargo.lock`
`tree-sitter-yaml`	`0.7.2`	`Cargo.lock`
`try-lock`	`0.2.5`	`Cargo.lock`
`typenum`	`1.20.1`	`Cargo.lock`
`typomania`	`0.2.0`	`Cargo.lock`
`unicode-general-category`	`1.1.0`	`Cargo.lock`
`unicode-ident`	`1.0.20`	`Cargo.lock`
`unicode-width`	`0.1.14`	`Cargo.lock`
`unicode-width`	`0.2.2`	`Cargo.lock`
`unicode-xid`	`0.2.6`	`Cargo.lock`
`unit-prefix`	`0.5.1`	`Cargo.lock`
`untrusted`	`0.9.0`	`Cargo.lock`
`url`	`2.5.8`	`Cargo.lock`
`utf8_iter`	`1.0.4`	`Cargo.lock`
`utf8parse`	`0.2.2`	`Cargo.lock`
`uuid`	`1.23.0`	`Cargo.lock`
`uuid-simd`	`0.8.0`	`Cargo.lock`
`valuable`	`0.1.1`	`Cargo.lock`
`version_check`	`0.9.5`	`Cargo.lock`
`vsimd`	`0.8.0`	`Cargo.lock`
`vt100`	`0.16.2`	`Cargo.lock`
`vte`	`0.15.0`	`Cargo.lock`
`wait-timeout`	`0.2.1`	`Cargo.lock`
`walkdir`	`2.5.0`	`Cargo.lock`
`want`	`0.3.1`	`Cargo.lock`
`wasi`	`0.11.1+wasi-snapshot-preview1`	`Cargo.lock`
`wasip2`	`1.0.1+wasi-0.2.4`	`Cargo.lock`
`wasip3`	`0.4.0+wasi-0.3.0-rc-2026-01-06`	`Cargo.lock`
`wasm-bindgen`	`0.2.108`	`Cargo.lock`
`wasm-bindgen-futures`	`0.4.58`	`Cargo.lock`
`wasm-bindgen-macro`	`0.2.108`	`Cargo.lock`
`wasm-bindgen-macro-support`	`0.2.108`	`Cargo.lock`
`wasm-bindgen-shared`	`0.2.108`	`Cargo.lock`
`wasm-encoder`	`0.244.0`	`Cargo.lock`
`wasm-metadata`	`0.244.0`	`Cargo.lock`
`wasm-streams`	`0.5.0`	`Cargo.lock`
`wasmparser`	`0.244.0`	`Cargo.lock`
`web-sys`	`0.3.85`	`Cargo.lock`
`web-time`	`1.1.0`	`Cargo.lock`
`webpki-root-certs`	`1.0.5`	`Cargo.lock`
`winapi`	`0.3.9`	`Cargo.lock`
`winapi-i686-pc-windows-gnu`	`0.4.0`	`Cargo.lock`
`winapi-util`	`0.1.11`	`Cargo.lock`
`winapi-x86_64-pc-windows-gnu`	`0.4.0`	`Cargo.lock`
`windows`	`0.62.2`	`Cargo.lock`
`windows-collections`	`0.3.2`	`Cargo.lock`
`windows-core`	`0.62.2`	`Cargo.lock`
`windows-future`	`0.3.2`	`Cargo.lock`
`windows-implement`	`0.60.2`	`Cargo.lock`
`windows-interface`	`0.59.3`	`Cargo.lock`
`windows-link`	`0.1.3`	`Cargo.lock`
`windows-link`	`0.2.1`	`Cargo.lock`
`windows-numerics`	`0.3.1`	`Cargo.lock`
`windows-registry`	`0.5.3`	`Cargo.lock`
`windows-result`	`0.3.4`	`Cargo.lock`
`windows-result`	`0.4.1`	`Cargo.lock`
`windows-strings`	`0.4.2`	`Cargo.lock`
`windows-strings`	`0.5.1`	`Cargo.lock`
`windows-sys`	`0.45.0`	`Cargo.lock`
`windows-sys`	`0.52.0`	`Cargo.lock`
`windows-sys`	`0.59.0`	`Cargo.lock`
`windows-sys`	`0.60.2`	`Cargo.lock`
`windows-sys`	`0.61.2`	`Cargo.lock`
`windows-targets`	`0.42.2`	`Cargo.lock`
`windows-targets`	`0.52.6`	`Cargo.lock`
`windows-targets`	`0.53.5`	`Cargo.lock`
`windows-threading`	`0.2.1`	`Cargo.lock`
`windows_aarch64_gnullvm`	`0.42.2`	`Cargo.lock`
`windows_aarch64_gnullvm`	`0.52.6`	`Cargo.lock`
`windows_aarch64_gnullvm`	`0.53.1`	`Cargo.lock`
`windows_aarch64_msvc`	`0.42.2`	`Cargo.lock`
`windows_aarch64_msvc`	`0.52.6`	`Cargo.lock`
`windows_aarch64_msvc`	`0.53.1`	`Cargo.lock`
`windows_i686_gnu`	`0.42.2`	`Cargo.lock`
`windows_i686_gnu`	`0.52.6`	`Cargo.lock`
`windows_i686_gnu`	`0.53.1`	`Cargo.lock`
`windows_i686_gnullvm`	`0.52.6`	`Cargo.lock`
`windows_i686_gnullvm`	`0.53.1`	`Cargo.lock`
`windows_i686_msvc`	`0.42.2`	`Cargo.lock`
`windows_i686_msvc`	`0.52.6`	`Cargo.lock`
`windows_i686_msvc`	`0.53.1`	`Cargo.lock`
`windows_x86_64_gnu`	`0.42.2`	`Cargo.lock`
`windows_x86_64_gnu`	`0.52.6`	`Cargo.lock`
`windows_x86_64_gnu`	`0.53.1`	`Cargo.lock`
`windows_x86_64_gnullvm`	`0.42.2`	`Cargo.lock`
`windows_x86_64_gnullvm`	`0.52.6`	`Cargo.lock`
`windows_x86_64_gnullvm`	`0.53.1`	`Cargo.lock`
`windows_x86_64_msvc`	`0.42.2`	`Cargo.lock`
`windows_x86_64_msvc`	`0.52.6`	`Cargo.lock`
`windows_x86_64_msvc`	`0.53.1`	`Cargo.lock`
`wit-bindgen`	`0.46.0`	`Cargo.lock`
`wit-bindgen`	`0.51.0`	`Cargo.lock`
`wit-bindgen-core`	`0.51.0`	`Cargo.lock`
`wit-bindgen-rust`	`0.51.0`	`Cargo.lock`
`wit-bindgen-rust-macro`	`0.51.0`	`Cargo.lock`
`wit-component`	`0.244.0`	`Cargo.lock`
`wit-parser`	`0.244.0`	`Cargo.lock`
`woodruffw-trough-tree-sitter-powershell`	`0.1.2`	`Cargo.lock`
`writeable`	`0.6.1`	`Cargo.lock`
`xattr`	`1.6.1`	`Cargo.lock`
`xxhash-rust`	`0.8.18`	`Cargo.lock`
`yaml_serde`	`0.10.7`	`Cargo.lock`
`yoke`	`0.8.0`	`Cargo.lock`
`yoke-derive`	`0.8.0`	`Cargo.lock`
`zerocopy`	`0.8.27`	`Cargo.lock`
`zerocopy-derive`	`0.8.27`	`Cargo.lock`
`zerofrom`	`0.1.6`	`Cargo.lock`
`zerofrom-derive`	`0.1.6`	`Cargo.lock`
`zeroize`	`1.8.2`	`Cargo.lock`
`zerotrie`	`0.2.2`	`Cargo.lock`
`zerovec`	`0.11.4`	`Cargo.lock`
`zerovec-derive`	`0.11.1`	`Cargo.lock`
`zlib-rs`	`0.6.7`	`Cargo.lock`
`zmij`	`1.0.23`	`Cargo.lock`

pypi (22)

Name	Version	Declared in
`click`	`8.3.1`	`uv.lock`
`colorama`	`0.4.6`	`uv.lock`
`deepmerge`	`2.0`	`uv.lock`
`iniconfig`	`2.3.0`	`uv.lock`
`jinja2`	`3.1.6`	`uv.lock`
`markdown`	`3.10`	`uv.lock`
`markdown-it-py`	`4.0.0`	`uv.lock`
`markupsafe`	`3.0.3`	`uv.lock`
`mdurl`	`0.1.2`	`uv.lock`
`packaging`	`25.0`	`uv.lock`
`pathspec`	`1.1.1`	`uv.lock`
`pluggy`	`1.6.0`	`uv.lock`
`pygments`	`2.20.0`	`uv.lock`
`pymdown-extensions`	`11.0.1`	`uv.lock`
`pytest`	`9.1.1`	`uv.lock`
`pytest-codspeed`	`5.0.3`	`uv.lock`
`pyyaml`	`6.0.3`	`uv.lock`
`rich`	`14.2.0`	`uv.lock`
`tomli`	`2.4.1`	`uv.lock`
`urllib3`	`2.8.0`	`uv.lock`
`zensical`	`0.0.68`	`uv.lock`
`zizmor`	`UNKNOWN`	`uv.lock`

github (21)

Name	Version	Declared in
`$/.github/workflows/release-binaries.yml`	`UNKNOWN`	`.github/workflows/release.yml`
`$/.github/workflows/release-crates.yml`	`UNKNOWN`	`.github/workflows/release.yml`
`$/.github/workflows/release-docker.yml`	`UNKNOWN`	`.github/workflows/release.yml`
`$/.github/workflows/release-pypi.yml`	`UNKNOWN`	`.github/workflows/release.yml`
`actions/attest`	`v4.2.2`	`.github/workflows/release-binaries.yml`
`actions/checkout`	`v7.0.1`	`.github/workflows/benchmark.yml`
`actions/configure-pages`	`v6.0.0`	`.github/workflows/site.yml`
`actions/deploy-pages`	`v5.0.1`	`.github/workflows/site.yml`
`actions/download-artifact`	`v8.0.1`	`.github/workflows/release-binaries.yml`
`actions/upload-artifact`	`v7.0.1`	`.github/workflows/release-binaries.yml`
`actions/upload-pages-artifact`	`v5.0.0`	`.github/workflows/site.yml`
`astral-sh/setup-uv`	`v10.2.0`	`.github/workflows/benchmark.yml`
`CodSpeedHQ/action`	`v5.4.0`	`.github/workflows/benchmark.yml`
`docker/github-builder/.github/workflows/build.yml`	`v1.17.0`	`.github/workflows/release-docker.yml`
`github/codeql-action/upload-sarif`	`v4.38.2`	`.github/workflows/test-output.yml`
`peter-evans/create-pull-request`	`v8.1.1`	`.github/workflows/codegen.yml`
`PyO3/maturin-action`	`v1.51.0`	`.github/workflows/release-pypi.yml`
`re-actors/alls-green`	`v1.3.0`	`.github/workflows/ci.yml`
`rust-lang/crates-io-auth-action`	`v1.0.5`	`.github/workflows/release-crates.yml`
`Swatinem/rust-cache`	`v2.9.2`	`.github/workflows/benchmark.yml`
`zizmorcore/zizmor-action`	`v0.6.4`	`.github/workflows/zizmor.yml`

unknown (10)

Name	Version	Declared in
`github-actions-expressions`	`1.31.1`	`Cargo.lock`
`github-actions-models`	`1.31.1`	`Cargo.lock`
`pre-commit-models`	`1.31.1`	`Cargo.lock`
`subfeature`	`1.31.1`	`Cargo.lock`
`tree-sitter-iter`	`1.31.1`	`Cargo.lock`
`yamlpatch`	`1.31.1`	`Cargo.lock`
`yamlpath`	`1.31.1`	`Cargo.lock`
`zizmor`	`1.31.1`	`Cargo.lock`
`zizmor-dev`	`1.31.1`	`Cargo.lock`
`zizmor-sarif`	`1.31.1`	`Cargo.lock`

History

Week	Version	Dependencies	Critical	High	Medium	Low	Unknown	Changes
2026-11-02	v1.31.1	494	0	0	2	2	0	—
2026-11-01	v1.31.1	494	0	0	2	2	0	—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Standard	Score	Checks passed	Failed checks
NTIA 2021	71	5/7	Supplier Name, Dependency Relationship
CISA 2025	50	5/10	Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183	44	4/9	Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/zizmorcore__zizmor/.

25 manifests and lockfiles scanned

.github/workflows/benchmark.yml, .github/workflows/ci.yml, .github/workflows/codegen.yml, .github/workflows/release-binaries.yml, .github/workflows/release-crates.yml, .github/workflows/release-docker.yml, .github/workflows/release-pypi.yml, .github/workflows/release.yml, .github/workflows/site.yml, .github/workflows/test-output.yml, .github/workflows/zizmor.yml, Cargo.lock, Cargo.toml, crates/github-actions-expressions/Cargo.toml, crates/github-actions-models/Cargo.toml, crates/pre-commit-models/Cargo.toml, crates/subfeature/Cargo.toml, crates/tree-sitter-iter/Cargo.toml, crates/yamlpatch/Cargo.toml, crates/yamlpath/Cargo.toml, crates/zizmor-dev/Cargo.toml, crates/zizmor-sarif/Cargo.toml, crates/zizmor/Cargo.toml, pyproject.toml, uv.lock

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fzizmorcore%2Fzizmor%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/zizmorcore/zizmor/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

Tool	What it does here	Version this week
Syft	Generates a CycloneDX SBOM from each release's manifests and lockfiles.	1.55.0
Grype	Matches the SBOM against known vulnerabilities.	0.121.0
OSV-Scanner	Checks the same files against the OSV database to confirm or add matches.	2.7.0
govulncheck	For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.	1.9.0
zizmor	Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.	1.31.1
OpenSSF Scorecard	Scores repository security practices such as code review, branch protection, and pinned dependencies.	5.6.0
Cosign	Verifies Sigstore signatures on the release binary or its checksums file.	3.1.4
slsa-verifier	Verifies SLSA build provenance published with the release.	2.7.1
GitHub CLI attestations	Verifies GitHub artifact attestations for the release binary.	—
sbomlyze	Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.	0.6.0