← Back to scan
File as GitHub Issue repo: frappe/education

Push this scan report to frappe/education

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Bare Except Pass

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 Missing import: `email` used but not imported education/patches/v15_0/fees_student_em…:7
CRIT DKC007 Compose service contains a literal secret environment value docker/docker-compose.yml:3
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… education/education/doctype/student_att…:214
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… education/education/doctype/course_sche…:30
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… education/education/doctype/course_sche…:84
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … education/education/doctype/course/cour…:42
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … education/education/doctype/assessment_…:28
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … education/education/billing.py:92
HIGH MINED108 `self.academic_term` used but never assigned in __init__ education/education/doctype/program_enr…:111
HIGH MINED108 `self.academic_year` used but never assigned in __init__ education/education/doctype/program_enr…:110
HIGH MINED108 `self.new_student_batch` used but never assigned in __init__ education/education/doctype/program_enr…:103
HIGH MINED108 `self.enrollment_date` used but never assigned in __init__ education/education/doctype/program_enr…:105
HIGH MINED108 `self.new_academic_term` used but never assigned in __init__ education/education/doctype/program_enr…:101
HIGH MINED108 `self.new_academic_year` used but never assigned in __init__ education/education/doctype/program_enr…:100
HIGH MINED108 `self.new_program` used but never assigned in __init__ education/education/doctype/program_enr…:99
HIGH MINED108 `self.students` used but never assigned in __init__ education/education/doctype/program_enr…:90
HIGH MINED108 `self.students` used but never assigned in __init__ education/education/doctype/program_enr…:89
HIGH MINED108 `self.program` used but never assigned in __init__ education/education/doctype/program_enr…:57
HIGH MINED108 `self.student_batch` used but never assigned in __init__ education/education/doctype/program_enr…:64
HIGH MINED108 `self.academic_term` used but never assigned in __init__ education/education/doctype/program_enr…:61
HIGH MINED108 `self.program` used but never assigned in __init__ education/education/doctype/program_enr…:40
HIGH MINED108 `self.academic_year` used but never assigned in __init__ education/education/doctype/program_enr…:58
HIGH MINED108 `self.academic_term` used but never assigned in __init__ education/education/doctype/program_enr…:44
HIGH MINED108 `self.academic_year` used but never assigned in __init__ education/education/doctype/program_enr…:41
HIGH MINED108 `self.student_batch` used but never assigned in __init__ education/education/doctype/program_enr…:62
HIGH MINED108 `self.academic_term` used but never assigned in __init__ education/education/doctype/program_enr…:60
HIGH MINED108 `self.get_students_from` used but never assigned in __init__ education/education/doctype/program_enr…:47
HIGH MINED108 `self.academic_term` used but never assigned in __init__ education/education/doctype/program_enr…:43
HIGH MINED108 `self.get_students_from` used but never assigned in __init__ education/education/doctype/program_enr…:30
HIGH MINED108 `self.academic_year` used but never assigned in __init__ education/education/doctype/program_enr…:27
HIGH MINED108 `self.program` used but never assigned in __init__ education/education/doctype/program_enr…:25
HIGH MINED108 `self.get_students_from` used but never assigned in __init__ education/education/doctype/program_enr…:23
HIGH MINED108 `self.set_onload` used but never assigned in __init__ education/education/doctype/program_enr…:18
HIGH MINED115 Action `pre-commit/action` pinned to mutable ref `@v3.0.1` .github/workflows/linters.yml:21
HIGH MINED115 Action `actions/setup-python` pinned to mutable ref `@v6` .github/workflows/linters.yml:16
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/linters.yml:13
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v4` .github/workflows/builds.yml:50
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v4` .github/workflows/builds.yml:23
HIGH MINED126 Workflow container/services image `mariadb:10.6` unpinned .github/workflows/ci.yml:35
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v4` .github/workflows/ci.yml:92
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v4` .github/workflows/ci.yml:78
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v4` .github/workflows/ci.yml:69
HIGH MINED115 Action `actions/setup-node` pinned to mutable ref `@v6` .github/workflows/ci.yml:60
HIGH MINED115 Action `actions/setup-python` pinned to mutable ref `@v6` .github/workflows/ci.yml:47
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v4` .github/workflows/ci.yml:44
HIGH MINED131 pre-commit hook `https://github.com/pre-commit/mirrors-prettier` pinned to mutable rev `v… .pre-commit-config.yaml:31
HIGH MINED131 pre-commit hook `https://github.com/PyCQA/flake8` pinned to mutable rev `5.0.4` .pre-commit-config.yaml:24
HIGH MINED131 pre-commit hook `https://github.com/pre-commit/pre-commit-hooks` pinned to mutable rev `v… .pre-commit-config.yaml:7
HIGH GHSA-3h5v-q93c-6h6q ws: GHSA-3h5v-q93c-6h6q frontend/yarn.lock
HIGH GHSA-c27g-q93r-2cwf vite: GHSA-c27g-q93r-2cwf frontend/yarn.lock
HIGH GHSA-677m-j7p3-52f9 socket.io-parser: GHSA-677m-j7p3-52f9 frontend/yarn.lock
HIGH GHSA-mw96-cpmx-2vgc rollup: GHSA-mw96-cpmx-2vgc frontend/yarn.lock
HIGH GHSA-gcx4-mw62-g8wm rollup: GHSA-gcx4-mw62-g8wm frontend/yarn.lock
HIGH GHSA-c2c7-rcm5-vvqj picomatch: GHSA-c2c7-rcm5-vvqj frontend/yarn.lock
HIGH GHSA-7r86-cg39-jmmj minimatch: GHSA-7r86-cg39-jmmj frontend/yarn.lock
HIGH GHSA-3ppc-4f35-3m26 minimatch: GHSA-3ppc-4f35-3m26 frontend/yarn.lock
HIGH GHSA-23c5-xmqv-rm74 minimatch: GHSA-23c5-xmqv-rm74 frontend/yarn.lock
HIGH GHSA-95jq-xph2-cx9h linkifyjs: GHSA-95jq-xph2-cx9h frontend/yarn.lock
HIGH GHSA-5j98-mcp5-4vw2 glob: GHSA-5j98-mcp5-4vw2 frontend/yarn.lock
HIGH GHSA-3xgq-45jj-v275 cross-spawn: GHSA-3xgq-45jj-v275 frontend/yarn.lock
HIGH GHSA-grv7-fg5c-xmjg braces: GHSA-grv7-fg5c-xmjg frontend/yarn.lock
MED SEC041 [SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blan… education/education/doctype/program_enr…:83
MED MINED111 Bare except continues silently education/education/doctype/quiz/quiz.py:45
MED MINED111 Bare except continues silently education/education/doctype/quiz/quiz.py:30
MED MINED111 Bare except continues silently education/education/doctype/course_sche…:103
MED MINED111 Bare except continues silently education/education/billing.py:125
MED MINED111 Bare except continues silently education/education/billing.py:39
MED MINED111 Bare except continues silently education/education/utils.py:229
MED COMP001 [COMP001] High cognitive complexity: Function `generate_fees` has cognitive complexity 18… education/education/doctype/fee_schedul…:162
MED DKR003 Compose service `frappe` image uses the latest tag docker/docker-compose.yml:22
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DEPCUR-NPM npm package `@vitejs/plugin-vue` is 4 major version(s) behind (^2.0.0 -> 6.0.7) frontend/package.json
MED DEPCUR-NPM npm package `vue-router` is 1 major version(s) behind (^4.0.12 -> 5.1.0) frontend/package.json
MED DEPCUR-NPM npm package `pinia` is 1 major version(s) behind (^2.1.7 -> 3.0.4) frontend/package.json
MED GHSA-48c2-rrv3-qjmp yaml: GHSA-48c2-rrv3-qjmp frontend/yarn.lock
MED GHSA-58qx-3vcg-4xpx ws: GHSA-58qx-3vcg-4xpx frontend/yarn.lock
MED GHSA-xcj6-pq6g-qj4x vite: GHSA-xcj6-pq6g-qj4x frontend/yarn.lock
MED GHSA-x574-m823-4x7w vite: GHSA-x574-m823-4x7w frontend/yarn.lock
MED GHSA-vg6x-rcgg-rjx6 vite: GHSA-vg6x-rcgg-rjx6 frontend/yarn.lock
MED GHSA-9cwx-2883-4wfx vite: GHSA-9cwx-2883-4wfx frontend/yarn.lock
MED GHSA-8jhw-289h-jh2g vite: GHSA-8jhw-289h-jh2g frontend/yarn.lock
MED GHSA-859w-5945-r5v3 vite: GHSA-859w-5945-r5v3 frontend/yarn.lock
MED GHSA-64vr-g452-qvp3 vite: GHSA-64vr-g452-qvp3 frontend/yarn.lock
MED GHSA-4w7w-66w2-5vf9 vite: GHSA-4w7w-66w2-5vf9 frontend/yarn.lock
MED GHSA-4r4m-qw57-chr8 vite: GHSA-4r4m-qw57-chr8 frontend/yarn.lock
MED GHSA-356w-63v5-8wf4 vite: GHSA-356w-63v5-8wf4 frontend/yarn.lock
MED GHSA-rmmh-p597-ppvv showdown: GHSA-rmmh-p597-ppvv frontend/yarn.lock
MED GHSA-qx2v-qp2m-jg93 postcss: GHSA-qx2v-qp2m-jg93 frontend/yarn.lock
MED GHSA-3v7f-55p6-f55p picomatch: GHSA-3v7f-55p6-f55p frontend/yarn.lock
MED GHSA-mwcw-c2x4-8c55 nanoid: GHSA-mwcw-c2x4-8c55 frontend/yarn.lock
MED GHSA-952p-6rrq-rcjv micromatch: GHSA-952p-6rrq-rcjv frontend/yarn.lock
MED GHSA-38c4-r59v-3vqw markdown-it: GHSA-38c4-r59v-3vqw frontend/yarn.lock
MED GHSA-67mh-4wv8-2f99 esbuild: GHSA-67mh-4wv8-2f99 frontend/yarn.lock
MED GHSA-f886-m6hf-6m8v brace-expansion: GHSA-f886-m6hf-6m8v frontend/yarn.lock
MED DKC015 Database service has no healthcheck docker/docker-compose.yml:3
MED AIC004 Suspicious implementation file appears unreferenced education/patches/v15_0/fee_schedule_st…:1
MED DKC013 Database service has no persistent data volume docker/docker-compose.yml:17
LOW COMP001 [COMP001] High cognitive complexity: Function `schedule_course` has cognitive complexity … education/education/doctype/course_sche…:17
LOW COMP001 [COMP001] High cognitive complexity: Function `add_quiz_activity` has cognitive complexit… education/education/doctype/course_enro…:52
LOW DEPCUR-NPM npm package `postcss` is minor version(s) behind (^8.4.5 -> 8.5.15) frontend/package.json
LOW DEPCUR-NPM npm package `autoprefixer` is minor version(s) behind (^10.4.2 -> 10.5.0) frontend/package.json
LOW DEPCUR-NPM npm package `qalendar` is minor version(s) behind (^3.6.1 -> 3.9.0) frontend/package.json
LOW DEPCUR-NPM npm package `feather-icons` is minor version(s) behind (^4.28.0 -> 4.29.2) frontend/package.json
LOW GHSA-jqfw-vq24-v9c3 vite: GHSA-jqfw-vq24-v9c3 frontend/yarn.lock
LOW GHSA-g4jq-h2w9-997c vite: GHSA-g4jq-h2w9-997c frontend/yarn.lock
LOW GHSA-v6h2-p8h4-qcjw brace-expansion: GHSA-v6h2-p8h4-qcjw frontend/yarn.lock
LOW GHSA-vhrc-hgrq-x75r @tiptap/extension-link: GHSA-vhrc-hgrq-x75r frontend/yarn.lock
LOW AIC003 Duplicated implementation block across source files frontend/src/pages/Fees.vue:13
LOW AIC003 Duplicated implementation block across source files frontend/src/components/Calendar.vue:113
LOW AIC003 Duplicated implementation block across source files education/education/report/student_batc…:1
LOW AIC003 Duplicated implementation block across source files education/education/report/final_assess…:38
LOW AIC003 Duplicated implementation block across source files education/education/doctype/quiz/quiz.js:28
LOW AIC003 Duplicated implementation block across source files education/education/doctype/fees/fees.js:32
LOW AIC003 Duplicated implementation block across source files education/education/doctype/fees/fees.js:29
LOW AIC003 Duplicated implementation block across source files education/education/doctype/fee_structu…:201
LOW AIC003 Duplicated implementation block across source files education/education/doctype/assessment_…:7
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
LOW DKC015 Database service has no healthcheck docker/docker-compose.yml:17
LOW AIC005 Duplicate top-level symbol appears in a patch-style file education/patches/v15_0/fee_schedule_st…:1
LOW DKC010 Compose service lacks no-new-privileges hardening docker/docker-compose.yml:22
LOW AIC002 Source file name looks like an AI patch artifact education/patches/v15_0/fee_schedule_st…:1
LOW DKC006 Compose service does not declare a runtime user docker/docker-compose.yml:22
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … frontend/src/stores/user.js:11
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … frontend/src/stores/student.js:24
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. education/education/doctype/assessment_…:8
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. education/education/doctype/assessment_…:8
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. education/education/__init__.py:5
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… education/education/doctype/assessment_…:9
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… education/education/doctype/article/art…:11
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… education/education/__init__.py:6
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… .github/helper/install.sh:10
INFO DEPCUR-NPM npm package `frappe-ui` is patch version(s) behind (^0.1.17 -> 0.1.278) frontend/package.json
INFO DEPCUR-NPM npm package `dayjs` is patch version(s) behind (^1.11.10 -> 1.11.21) frontend/package.json
Reset to top 5 133 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `frappe/education`

**Score: 68/100 (C)**  ·  136 findings  ·  scanned 2026-06-05 12:59 UTC  ·  14,554 LOC

| Severity | Count |
|---|---|
| CRITICAL | 2 |
| HIGH | 59 |
| MEDIUM | 36 |
| LOW | 25 |

📊 [Full filterable report](https://repobility.com/scan/0128f2aa-c13e-41b2-8af4-4451785204ab/)  ·  ![scorecard](https://repobility.com/scan/0128f2aa-c13e-41b2-8af4-4451785204ab/report.png?v=1780664351-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `email` used but not imported
   `education/patches/v15_0/fees_student_email.py:7` · ✓ Repobility
2. **CRITICAL** `DKC007` — Compose service contains a literal secret environment value
   `docker/docker-compose.yml:3`
3. **HIGH** `SEC040` — innerHTML XSS — template literal with server-supplied data
   `education/education/doctype/student_attendance_tool/student_attendance_tool.js:214` · CWE-79 · A03:2021 Injection (XSS)
4. **HIGH** `SEC040` — innerHTML XSS — template literal with server-supplied data
   `education/education/doctype/course_scheduling_tool/course_scheduling_tool.js:30` · CWE-79 · A03:2021 Injection (XSS)
5. **HIGH** `MINED001` — Bare Except Pass
   `education/education/doctype/course_schedule/course_schedule.py:84` · CWE-755 · ✓ Repobility

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/0128f2aa-c13e-41b2-8af4-4451785204ab/_
Megaproject â high spam risk
Could not determine 'frappe/education' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.