{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6d24705a7d2e56a6", "name": "Possibly dead Python function: trigger_alert", "shortDescription": {"text": "Possibly dead Python function: trigger_alert"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f7f84e7c4026862", "name": "Possibly dead Python function: resolve_alert", "shortDescription": {"text": "Possibly dead Python function: resolve_alert"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e649b65d2a3968a3", "name": "Possibly dead Python function: identify_user", "shortDescription": {"text": "Possibly dead Python function: identify_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77328219c3dadd01", "name": "Possibly dead Python function: is_feature_enabled", "shortDescription": {"text": "Possibly dead Python function: is_feature_enabled"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-437af83a1c2e5e70", "name": "Possibly dead Python function: validate_row_ids", "shortDescription": {"text": "Possibly dead Python function: validate_row_ids"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02a2892d8b82d48f", "name": "Possibly dead Python function: validate_key", "shortDescription": {"text": "Possibly dead Python function: validate_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa0a1fc947d8ae8b", "name": "Possibly dead Python function: validate_value", "shortDescription": {"text": "Possibly dead Python function: validate_value"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbcae357b215a7a7", "name": "Possibly dead Python function: validate_response_format", "shortDescription": {"text": "Possibly dead Python function: validate_response_format"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96c59650efbde64d", "name": "Possibly dead Python function: validate_name", "shortDescription": {"text": "Possibly dead Python function: validate_name"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9adb00be2caf92f", "name": "Possibly dead Python function: validate_input_mappings", "shortDescription": {"text": "Possibly dead Python function: validate_input_mappings"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23a23aa81ab9bcb6", "name": "Possibly dead Python function: build_input_payload", "shortDescription": {"text": "Possibly dead Python function: build_input_payload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b7df1acc98f87b6", "name": "Possibly dead Python function: replacer", "shortDescription": {"text": "Possibly dead Python function: replacer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4fdba0cf86df4d8", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/utils/logger.js:64", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/utils/logger.js:64"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-70e8fe84d16c1fbc", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/components/traceDetail/SpanDetailPane.jsx:120", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/components/traceDetail/SpanDetailPane.jsx:120"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-8277fe55a49a64fd", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/components/imagine/widgets/WidgetMarkdown.jsx:75", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/components/imagine/widgets/WidgetMarkdown.jsx:75"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-8129e55074c06c16", "name": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx:2363", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx:2363"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-e8c5196d861ad4d9", "name": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/workbench-v2/components/PromptItem.jsx:327", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/workbench-v2/components/PromptItem.jsx:327"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-a699bd68c2660e89", "name": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/scenarios/CreateScenarioView.jsx:506", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/scenarios/CreateScenarioView.jsx:506"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-76130287cee69810", "name": "Custom React Flow node registered without explicit width/height \u2014 frontend/src/sections/agent-playground/utils/__tests__", "shortDescription": {"text": "Custom React Flow node registered without explicit width/height \u2014 frontend/src/sections/agent-playground/utils/__tests__/workflowValidation.test.js:154"}, "fullDescription": {"text": "When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: \u2026, height: \u2026` to the node object. See P-I.\n\nWhy: P-I in CHECKLIST.md \u2014 RF MiniMap + fitView need explicit dims on custom nodes.\nRule id: fq.rfnode.no-dims"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-7fc358e20750272d", "name": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVari", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariableDrawer.jsx:37"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-b7a8cbf1b2248a3e", "name": "Custom React Flow node registered without explicit width/height \u2014 frontend/src/sections/agent-playground/Overview/__test", "shortDescription": {"text": "Custom React Flow node registered without explicit width/height \u2014 frontend/src/sections/agent-playground/Overview/__tests__/OverviewGraphPreview.test.jsx:43"}, "fullDescription": {"text": "When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: \u2026, height: \u2026` to the node object. See P-I.\n\nWhy: P-I in CHECKLIST.md \u2014 RF MiniMap + fitView need explicit dims on custom nodes.\nRule id: fq.rfnode.no-dims"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-b7eea64b4cd7edd3", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/layouts/common/notifications-popover/notification-ite", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/layouts/common/notifications-popover/notification-item.jsx:260"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-5d2721b32a2fc1a5", "name": "math random used \u2014 agentcc-gateway/internal/middleware/requestid.go:4", "shortDescription": {"text": "math random used \u2014 agentcc-gateway/internal/middleware/requestid.go:4"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-8dd39fc173f96735", "name": "math random used \u2014 agentcc-gateway/internal/routing/adaptive.go:5", "shortDescription": {"text": "math random used \u2014 agentcc-gateway/internal/routing/adaptive.go:5"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-75129616e02ba1ca", "name": "math random used \u2014 agentcc-gateway/internal/routing/mirror.go:9", "shortDescription": {"text": "math random used \u2014 agentcc-gateway/internal/routing/mirror.go:9"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-b0fa10e39c2e87f7", "name": "math random used \u2014 agentcc-gateway/internal/routing/retry.go:7", "shortDescription": {"text": "math random used \u2014 agentcc-gateway/internal/routing/retry.go:7"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-39e119291a63fbfc", "name": "math random used \u2014 agentcc-gateway/internal/routing/weighted.go:5", "shortDescription": {"text": "math random used \u2014 agentcc-gateway/internal/routing/weighted.go:5"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e76cbf06fb4c9098", "name": "math random used \u2014 fi-collector/cmd/loadgen/fabricate.go:5", "shortDescription": {"text": "math random used \u2014 fi-collector/cmd/loadgen/fabricate.go:5"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e363f4b95b876590", "name": "math random used \u2014 fi-collector/cmd/loadgen/main.go:13", "shortDescription": {"text": "math random used \u2014 fi-collector/cmd/loadgen/main.go:13"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-676be582b106edca", "name": "math random used \u2014 fi-collector/pkg/chwriter/writer.go:29", "shortDescription": {"text": "math random used \u2014 fi-collector/pkg/chwriter/writer.go:29"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-321b765db7187e80", "name": "header redefinition \u2014 frontend/nginx.conf:42", "shortDescription": {"text": "header redefinition \u2014 frontend/nginx.conf:42"}, "fullDescription": {"text": "The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\nRule: generic.nginx.security.header-redefinition.header-redefinition\nSeverity: WARNING\nOWASP: A06:2017 - Security Misconfiguration, A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-16: CWE CATEGORY: Configuration\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-69918f8dad9529a9", "name": "react dangerouslysetinnerhtml \u2014 frontend/src/components/imagine/widgets/WidgetMarkdown.jsx:75", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/components/imagine/widgets/WidgetMarkdown.jsx:75"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-fefdae1fc1cd5a59", "name": "react dangerouslysetinnerhtml \u2014 frontend/src/components/traceDetail/SpanDetailPane.jsx:120", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/components/traceDetail/SpanDetailPane.jsx:120"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-91a7875d99a444fa", "name": "react dangerouslysetinnerhtml \u2014 frontend/src/layouts/common/notifications-popover/notification-item.jsx:260", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/layouts/common/notifications-popover/notification-item.jsx:260"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-4c880cf3087df3e9", "name": "unvalidated password \u2014 futureagi/accounts/models/user.py:23", "shortDescription": {"text": "unvalidated password \u2014 futureagi/accounts/models/user.py:23"}, "fullDescription": {"text": "The password on 'user' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\nRule: python.django.security.audit.unvalidated-password.unvalidated-password\nSeverity: WARNING\nOWASP: A07:2021 - Identification and Authentication Failures, A07:2025 - Authentication Failures\nCWE: CWE-521: Weak Password Requirements\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-5511b710f57bd46f", "name": "template unescaped with safe \u2014 futureagi/accounts/templates/saml2_auth/login.html:15", "shortDescription": {"text": "template unescaped with safe \u2014 futureagi/accounts/templates/saml2_auth/login.html:15"}, "fullDescription": {"text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability.\n\nRule: python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-58663cfcdf720d75", "name": "unvalidated password \u2014 futureagi/accounts/views/appsmith.py:87", "shortDescription": {"text": "unvalidated password \u2014 futureagi/accounts/views/appsmith.py:87"}, "fullDescription": {"text": "The password on 'user' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\nRule: python.django.security.audit.unvalidated-password.unvalidated-password\nSeverity: WARNING\nOWASP: A07:2021 - Identification and Authentication Failures, A07:2025 - Authentication Failures\nCWE: CWE-521: Weak Password Requirements\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-25947adbde8bbfd5", "name": "unvalidated password \u2014 futureagi/accounts/views/workspace.py:383", "shortDescription": {"text": "unvalidated password \u2014 futureagi/accounts/views/workspace.py:383"}, "fullDescription": {"text": "The password on 'new_member' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\nRule: python.django.security.audit.unvalidated-password.unvalidated-password\nSeverity: WARNING\nOWASP: A07:2021 - Identification and Authentication Failures, A07:2025 - Authentication Failures\nCWE: CWE-521: Weak Password Requirements\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-710b21cfbcb75470", "name": "unvalidated password \u2014 futureagi/accounts/views/workspace_management.py:584", "shortDescription": {"text": "unvalidated password \u2014 futureagi/accounts/views/workspace_management.py:584"}, "fullDescription": {"text": "The password on 'new_member' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\nRule: python.django.security.audit.unvalidated-password.unvalidated-password\nSeverity: WARNING\nOWASP: A07:2021 - Identification and Authentication Failures, A07:2025 - Authentication Failures\nCWE: CWE-521: Weak Password Requirements\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ffafa7bbe34ea157", "name": "use defused xml \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/functions.py:2282", "shortDescription": {"text": "use defused xml \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/functions.py:2282"}, "fullDescription": {"text": "The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service.\n\nRule: python.lang.security.use-defused-xml.use-defused-xml\nSeverity: ERROR\nOWASP: A04:2017 - XML External Entities (XXE), A05:2021 - Security Misconfiguration, A02:2025 - Security Misconfiguration\nCWE: CWE-611: Improper Restriction of XML External Entity Reference\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-e6ba3f3f699db541", "name": "dynamic urllib use detected \u2014 futureagi/agentic_eval/core_evals/fi_evals/llm/custom_prompt_evaluator/file_processor.py:1", "shortDescription": {"text": "dynamic urllib use detected \u2014 futureagi/agentic_eval/core_evals/fi_evals/llm/custom_prompt_evaluator/file_processor.py:117"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ea3ed84f647e7f00", "name": "exec detected \u2014 futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py:257", "shortDescription": {"text": "exec detected \u2014 futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py:257"}, "fullDescription": {"text": "Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\nRule: python.lang.security.audit.exec-detected.exec-detected\nSeverity: WARNING\nOWASP: A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-5f186e135538890b", "name": "dynamic urllib use detected \u2014 futureagi/agentic_eval/core_evals/fi_utils/sandbox.py:474", "shortDescription": {"text": "dynamic urllib use detected \u2014 futureagi/agentic_eval/core_evals/fi_utils/sandbox.py:474"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c6fb234579f97a05", "name": "dynamic urllib use detected \u2014 futureagi/bin/install_nltk_data.py:57", "shortDescription": {"text": "dynamic urllib use detected \u2014 futureagi/bin/install_nltk_data.py:57"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-87df2f65b1645736", "name": "insecure hash algorithm sha1 \u2014 futureagi/ee/agenthub/traceerroragent/memory.py:150", "shortDescription": {"text": "insecure hash algorithm sha1 \u2014 futureagi/ee/agenthub/traceerroragent/memory.py:150"}, "fullDescription": {"text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-1452f6cbfbac4891", "name": "dynamic urllib use detected \u2014 futureagi/ee/evals/llm/agent_evaluator/evaluator.py:395", "shortDescription": {"text": "dynamic urllib use detected \u2014 futureagi/ee/evals/llm/agent_evaluator/evaluator.py:395"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-a3a6f20ba50eb4a5", "name": "dynamic urllib use detected \u2014 futureagi/ee/evals/llm/custom_prompt_evaluator/file_processor.py:117", "shortDescription": {"text": "dynamic urllib use detected \u2014 futureagi/ee/evals/llm/custom_prompt_evaluator/file_processor.py:117"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-8e51931d66effe78", "name": "var in href \u2014 futureagi/model_hub/templates/annotation_daily_digest.html:55", "shortDescription": {"text": "var in href \u2014 futureagi/model_hub/templates/annotation_daily_digest.html:55"}, "fullDescription": {"text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\nRule: generic.html-templates.security.var-in-href.var-in-href\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-9af3cd00d933b4c1", "name": "var in href \u2014 futureagi/model_hub/templates/annotation_realtime_digest.html:55", "shortDescription": {"text": "var in href \u2014 futureagi/model_hub/templates/annotation_realtime_digest.html:55"}, "fullDescription": {"text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\nRule: generic.html-templates.security.var-in-href.var-in-href\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-58130fcc5ee991cf", "name": "extends custom expression \u2014 futureagi/model_hub/utils/eval_list.py:474", "shortDescription": {"text": "extends custom expression \u2014 futureagi/model_hub/utils/eval_list.py:474"}, "fullDescription": {"text": "Found extension of custom expression: _LowerArray. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\nRule: python.django.security.audit.extends-custom-expression.extends-custom-expression\nSeverity: WARNING\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-5c932fc6c4d62ebf", "name": "avoid query set extra \u2014 futureagi/simulate/utils/persona_filtering.py:131", "shortDescription": {"text": "avoid query set extra \u2014 futureagi/simulate/utils/persona_filtering.py:131"}, "fullDescription": {"text": "QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\nRule: python.django.security.audit.query-set-extra.avoid-query-set-extra\nSeverity: WARNING\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-040538a0fe39de0b", "name": "avoid query set extra \u2014 futureagi/simulate/utils/test_execution_utils.py:163", "shortDescription": {"text": "avoid query set extra \u2014 futureagi/simulate/utils/test_execution_utils.py:163"}, "fullDescription": {"text": "QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\nRule: python.django.security.audit.query-set-extra.avoid-query-set-extra\nSeverity: WARNING\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c86ba97bc104b5eb", "name": "template unescaped with safe \u2014 futureagi/tfc/templates/admin/usage/custom_pricing.html:201", "shortDescription": {"text": "template unescaped with safe \u2014 futureagi/tfc/templates/admin/usage/custom_pricing.html:201"}, "fullDescription": {"text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability.\n\nRule: python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-225eef821628cdc8", "name": "template unescaped with safe \u2014 futureagi/tfc/templates/admin/usage/generate_invoice.html:111", "shortDescription": {"text": "template unescaped with safe \u2014 futureagi/tfc/templates/admin/usage/generate_invoice.html:111"}, "fullDescription": {"text": "Detected a segment of a Flask template where autoescaping is explicitly disabled with '| safe' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability.\n\nRule: python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-68651a569a7486f0", "name": "http not https connection \u2014 futureagi/tfc/utils/ssrf_guard.py:136", "shortDescription": {"text": "http not https connection \u2014 futureagi/tfc/utils/ssrf_guard.py:136"}, "fullDescription": {"text": "Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\nRule: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-2d711b7f879320b3", "name": "avoid raw sql \u2014 futureagi/tracer/queries/projects.py:41", "shortDescription": {"text": "avoid raw sql \u2014 futureagi/tracer/queries/projects.py:41"}, "fullDescription": {"text": "Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\nRule: python.django.security.audit.raw-query.avoid-raw-sql\nSeverity: WARNING\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-18a688d59f6e619c", "name": "dynamic urllib use detected \u2014 futureagi/tracer/services/clickhouse/v2/catalog_dev_schema.py:156", "shortDescription": {"text": "dynamic urllib use detected \u2014 futureagi/tracer/services/clickhouse/v2/catalog_dev_schema.py:156"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-6ba6e3a8e092ad6e", "name": "extends custom expression \u2014 futureagi/tracer/views/eval_task.py:92", "shortDescription": {"text": "extends custom expression \u2014 futureagi/tracer/views/eval_task.py:92"}, "fullDescription": {"text": "Found extension of custom expression: _RegexpReplace. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\nRule: python.django.security.audit.extends-custom-expression.extends-custom-expression\nSeverity: WARNING\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-7973be9f3af266ff", "name": "CVE-2026-33815: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-33815: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability\n\nMemory-safety vulnerability in github.com/jackc/pgx/v5.\n\nPackage: github.com/jackc/pgx/v5\nInstalled: v5.7.4\nFixed in: 5.9.0\nSeverity: CRITICAL\nFix: Upgrade github.com/jackc/pgx/v5 to 5.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ce8e0245444a7e3a", "name": "CVE-2026-33816: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-33816: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability\n\nMemory-safety vulnerability in github.com/jackc/pgx/v5.\n\nPackage: github.com/jackc/pgx/v5\nInstalled: v5.7.4\nFixed in: 5.9.0\nSeverity: CRITICAL\nFix: Upgrade github.com/jackc/pgx/v5 to 5.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4522dfc9e115378f", "name": "CVE-2026-41889: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-41889: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions\n\npgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.\n\nPackage: github.com/jackc/pgx/v5\nInstalled: v5.7.4\nFixed in: 5.9.2\nSeverity: LOW\nFix: Upgrade github.com/jackc/pgx/v5 to 5.9.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86c14f9eaf140ad1", "name": "CVE-2026-39828: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39828: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions\n\nWhen an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-376fecfed35459ff", "name": "CVE-2026-39829: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39829: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters\n\nThe RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d24e9bc533bf603", "name": "CVE-2026-39830: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39830: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses\n\nA malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4735d1a5ccce051d", "name": "CVE-2026-39831: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39831: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check\n\nThe Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83150d2dad5849f3", "name": "CVE-2026-39832: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39832: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions\n\nWhen adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e6833d836ba0314", "name": "CVE-2026-39835: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39835: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate\n\nSSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-929a6f2d4c496d8f", "name": "CVE-2026-42508: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-42508: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey\n\nPreviously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9699ca60e01cce8c", "name": "CVE-2026-46595: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-46595: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation\n\nPreviously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56b0ae3b4e4bd754", "name": "CVE-2026-46597: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-46597: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs\n\nAn incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-610d0551627b33ca", "name": "CVE-2026-56854: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-56854: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions\n\nThe source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is \n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.55.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e4e8746747d33a8", "name": "CVE-2026-39827: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39827: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings\n\nAn authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11333d7022d30086", "name": "CVE-2026-39833: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39833: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation\n\nThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f10b282602cad725", "name": "CVE-2026-39834: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39834: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write\n\nWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16b4de74ff4b8272", "name": "CVE-2026-46598: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-46598: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input\n\nFor certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6648dffd04dfd15", "name": "CVE-2026-56855: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-56855: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages\n\nPreviously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9be5651889708f23", "name": "CVE-2026-78662: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-78662: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding\n\nPreviously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d566592d38a06502", "name": "GO-2026-5932: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "GO-2026-5932: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues\n\nThe golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.\n\nPackage: golang.org/x/crypto\nInstalled: v0.48.0\nFixed in: \u2014\nSeverity: UNKNOWN\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ff5c0276bdcf4f0b", "name": "CVE-2026-25681: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-25681: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting\n\nParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.55.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/net to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14a3047322e409e4", "name": "CVE-2026-27136: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-27136: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass\n\nParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.55.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/net to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-210cea3f4a797c32", "name": "CVE-2026-33814: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-33814: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame\n\nWhen processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.53.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/net to 0.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aac2a6590f964f07", "name": "CVE-2026-39821: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39821: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing\n\nThe ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to U\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.55.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/net to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2eb7520952ab6402", "name": "CVE-2026-46600: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-46600: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.56.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/net to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdefc7f40c6e8513", "name": "CVE-2026-25680: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-25680: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing\n\nParsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.55.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/net to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa9e84a6d5433330", "name": "CVE-2026-42502: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-42502: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering\n\nParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.55.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/net to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b174eb905f6eeb1", "name": "CVE-2026-42506: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-42506: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing\n\nParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.\n\nPackage: golang.org/x/net\nInstalled: v0.49.0\nFixed in: 0.55.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/net to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04db8ba0fa5dc2bc", "name": "CVE-2026-39824: golang.org/x/sys v0.41.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-39824: golang.org/x/sys v0.41.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows\n\nNewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.\n\nPackage: golang.org/x/sys\nInstalled: v0.41.0\nFixed in: 0.44.0\nSeverity: UNKNOWN\nFix: Upgrade golang.org/x/sys to 0.44.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dc14cc056d111770", "name": "CVE-2026-56852: golang.org/x/text v0.34.0 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-56852: golang.org/x/text v0.34.0 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input\n\nA norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\n\nPackage: golang.org/x/text\nInstalled: v0.34.0\nFixed in: 0.39.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/text to 0.39.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41f65262a1b66b31", "name": "CVE-2026-33186: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-33186: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation\n\ngRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc\n\nPackage: google.golang.org/grpc\nInstalled: v1.67.1\nFixed in: 1.79.3\nSeverity: CRITICAL\nFix: Upgrade google.golang.org/grpc to 1.79.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5af9a8d1e930f2b4", "name": "CVE-2026-84304: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-84304: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...\n\ngRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buff\n\nPackage: google.golang.org/grpc\nInstalled: v1.67.1\nFixed in: 1.83.1\nSeverity: HIGH\nFix: Upgrade google.golang.org/grpc to 1.83.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1bd13534518539c3", "name": "CVE-2026-84445: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-84445: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests\n\ngRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by t\n\nPackage: google.golang.org/grpc\nInstalled: v1.67.1\nFixed in: 1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e\nSeverity: HIGH\nFix: Upgrade google.golang.org/grpc to 1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-283886efdc2ea200", "name": "GHSA-hrxh-6v49-42gf: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod", "shortDescription": {"text": "GHSA-hrxh-6v49-42gf: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities\n\nMultiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream r\n\nPackage: google.golang.org/grpc\nInstalled: v1.67.1\nFixed in: 1.82.1\nSeverity: HIGH\nFix: Upgrade google.golang.org/grpc to 1.82.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2818d23f53bf3de2", "name": "CVE-2026-84303: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod", "shortDescription": {"text": "CVE-2026-84303: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "fullDescription": {"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...\n\ngRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host\n\nPackage: google.golang.org/grpc\nInstalled: v1.67.1\nFixed in: 1.83.1\nSeverity: MEDIUM\nFix: Upgrade google.golang.org/grpc to 1.83.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08d10c60d1734d38", "name": "CVE-2026-49356: @babel/core 7.29.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment\n\nBabel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 an\n\nPackage: @babel/core\nInstalled: 7.29.0\nFixed in: 8.0.0-rc.6, 7.29.6\nSeverity: LOW\nFix: Upgrade @babel/core to 8.0.0-rc.6, 7.29.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c22e606ca292f18", "name": "CVE-2025-27789: @babel/runtime 7.24.6 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-27789: @babel/runtime 7.24.6 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups\n\nBabel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, usi\n\nPackage: @babel/runtime\nInstalled: 7.24.6\nFixed in: 7.26.10, 8.0.0-alpha.17\nSeverity: MEDIUM\nFix: Upgrade @babel/runtime to 7.26.10, 8.0.0-alpha.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43ee72f334e57cf0", "name": "CVE-2026-54285: @opentelemetry/core 2.2.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 2.2.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 2.2.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86b6350d9bdcc423", "name": "CVE-2026-54285: @opentelemetry/core 2.6.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 2.6.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 2.6.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b0462786256cbdf", "name": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: @protobufjs/utf8\nInstalled: 1.1.0\nFixed in: 1.1.1\nSeverity: MEDIUM\nFix: Upgrade @protobufjs/utf8 to 1.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-152614caaba55157", "name": "CVE-2026-22029: @remix-run/router 1.9.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-22029: @remix-run/router 1.9.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects\n\nReact Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<\n\nPackage: @remix-run/router\nInstalled: 1.9.0\nFixed in: 1.23.2\nSeverity: HIGH\nFix: Upgrade @remix-run/router to 1.23.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2934cb75d325ca5b", "name": "CVE-2026-40181: @remix-run/router 1.9.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-40181: @remix-run/router 1.9.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "react-router: React Router: Open redirect vulnerability via specially crafted URLs\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.\n\nPackage: @remix-run/router\nInstalled: 1.9.0\nFixed in: 1.23.3\nSeverity: MEDIUM\nFix: Upgrade @remix-run/router to 1.23.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-786bd0f029d682b5", "name": "CVE-2024-39338: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2024-39338: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: axios: Server-Side Request Forgery\n\naxios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.7.4\nSeverity: HIGH\nFix: Upgrade axios to 1.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e173ac9b0e1358e0", "name": "CVE-2025-27152: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-27152: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests\n\naxios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if \u2060baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.8.2, 0.30.0\nSeverity: HIGH\nFix: Upgrade axios to 1.8.2, 0.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b855297209f5f210", "name": "CVE-2025-58754: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-58754: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios DoS via lack of data size check\n\nAxios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI a\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.12.0, 0.30.2\nSeverity: HIGH\nFix: Upgrade axios to 1.12.0, 0.30.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-100695dba2b20258", "name": "CVE-2026-25639: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-25639: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56b2f7e93c8fd20c", "name": "CVE-2026-42033: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42033: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-02e9ef80522b683a", "name": "CVE-2026-42035: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42035: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d4985ddf640d03d3", "name": "CVE-2026-42043: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42043: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb98af8372447547", "name": "CVE-2026-42264: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42264: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation\n\nAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.2\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e8e67511fab1e72", "name": "CVE-2026-44486: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44486: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d8adae695151795", "name": "CVE-2026-44487: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44487: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ad909d76f4abc827", "name": "CVE-2026-44494: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44494: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21d20849e290ee4e", "name": "CVE-2026-44495: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44495: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e94a88bc10c4484f", "name": "CVE-2026-44496: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44496: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1f54a33944a15a9", "name": "CVE-2023-45857: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2023-45857: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: exposure of confidential data stored in cookies\n\nAn issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.6.0, 0.28.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.6.0, 0.28.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d8a5db339bd53d0", "name": "CVE-2025-62718: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-62718: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55a0c452286da702", "name": "CVE-2026-40175: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-40175: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3813a648bfd6d214", "name": "CVE-2026-42034: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42034: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a453d9ccf871ca6b", "name": "CVE-2026-42036: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42036: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edfc51855a96df2b", "name": "CVE-2026-42037: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42037: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-624300467a1bf103", "name": "CVE-2026-42038: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42038: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98a5188445a92a06", "name": "CVE-2026-42039: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42039: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b877fc75552f6097", "name": "CVE-2026-42041: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42041: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd87d9293e7b2769", "name": "CVE-2026-42042: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42042: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c358d2f39e527467", "name": "CVE-2026-42044: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42044: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, \n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.2\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16b27123e6301dc6", "name": "CVE-2026-44490: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44490: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7fcd024adac37a3", "name": "CVE-2026-67312: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-67312: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing\n\naxios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and c\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-748a95aae39cf355", "name": "CVE-2026-67313: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-67313: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios versions 0.28.0 and later contain uncontrolled recursion in form ...\n\naxios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60563ce0990085c6", "name": "CVE-2026-67316: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-67316: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection\n\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling export\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f960ea4c01d0048b", "name": "CVE-2026-67319: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-67319: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: axios: Information disclosure and data manipulation via prototype pollution\n\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited user\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dff5f3887c87580e", "name": "CVE-2026-42040: axios 1.5.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-42040: axios 1.5.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73cd0946e9ad6f86", "name": "CVE-2026-45819: baseline-browser-mapping 2.10.16 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-45819: baseline-browser-mapping 2.10.16 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling\n\nbaseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.\n\nPackage: baseline-browser-mapping\nInstalled: 2.10.16\nFixed in: 2.11.0\nSeverity: MEDIUM\nFix: Upgrade baseline-browser-mapping to 2.11.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d347c181b5c7b17", "name": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c6f62058478dec2", "name": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ae8d292c7c986ff", "name": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ebc362d18f81f01", "name": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-523e7820e463014a", "name": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbb26c38aeae0c37", "name": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c588ff13dcd24125", "name": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-058c7dd145941f5e", "name": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e6575201f24d8c4", "name": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f69918bfd06aa8ba", "name": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f122e2fca846811", "name": "CVE-2026-73088: browserslist 4.28.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-73088: browserslist 4.28.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "browserslist: Browserslist: Prototype pollution leading to denial of service\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasO\n\nPackage: browserslist\nInstalled: 4.28.2\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a105a3350cfc4ec", "name": "CVE-2026-73089: browserslist 4.28.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-73089: browserslist 4.28.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memo\n\nPackage: browserslist\nInstalled: 4.28.2\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4094828578c767cd", "name": "CVE-2026-41238: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-41238: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10357469cd81aca4", "name": "CVE-2026-41239: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-41239: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7091aeaa2153514", "name": "CVE-2026-41240: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-41240: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive \n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f5082fe816cf6af", "name": "CVE-2026-49458: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-49458: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb3904bcb935c33c", "name": "CVE-2026-49459: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-49459: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c03436c3a2c3d4a6", "name": "CVE-2026-49978: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-49978: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0094635c9c5f20bd", "name": "CVE-2026-65898: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-65898: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution\n\nDOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.11\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc05d34b07142d88", "name": "CVE-2026-65902: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-65902: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Sanitization bypass via hook manipulation\n\nDOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitiz\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f26dde6c55abde8", "name": "CVE-2026-65903: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-65903: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Security bypass allows injection of malicious content\n\nDOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98f642e36e5eb776", "name": "GHSA-55q2-fjhq-7xh7: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS\n\n### Summary\n\nDuring `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onload` handler and fire after `sanitize()` returns, even though the returned root is clean and the image remains disconnected from the document.\n\n### Details\n\nIn DOMPurify 3.4.12, `_sanitizeElements()` in `src/purify.ts:1862-1904` runs the `beforeSanitizeElements` or `uponSanitizeElement` hook and returns immed\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.13\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c319932ac134ca8", "name": "CVE-2026-65899: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-65899: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset\n\nDOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call als\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.9\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20e946199ce73515", "name": "CVE-2026-65900: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-65900: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Template expression injection allows information disclosure\n\nDOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.8\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a83a4d39b327ca7", "name": "CVE-2026-65901: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-65901: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName\n\nDOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29dd7bfaa11730d9", "name": "GHSA-c2j3-45gr-mqc4: dompurify 3.3.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\n## Summary\n\nThere is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`.\n\nWhen a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it appears that the element does not go through `afterSanitizeElements` in the same way as a normal element. As a result, an application that relies on `afterSanitizeElements` as a security policy layer to strip sensitive attributes from all elements may see those attributes removed from normal elements bu\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.12\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-431d8b6ba442560b", "name": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.4.8\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07616f3c257ceee1", "name": "CVE-2026-45820: fflate 0.7.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-45820: fflate 0.7.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.7.4\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1011951def01e906", "name": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()\n\nVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.15.4\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a08637610db0f4d9", "name": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "follow-redirects: Possible credential leak\n\nfollow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.15.6\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cd10585d657e0ae", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-130674c8daeef1a5", "name": "CVE-2025-7783: form-data 4.0.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "form-data: Unsafe random function in form-data\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.4, 3.0.4, 4.0.4\nSeverity: CRITICAL\nFix: Upgrade form-data to 2.5.4, 3.0.4, 4.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fa4f3605db04dee2", "name": "CVE-2026-12143: form-data 4.0.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-264b1877a86e58eb", "name": "CVE-2026-4800: lodash 4.17.21 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab31bffc25b6dd04", "name": "CVE-2025-13465: lodash 4.17.21 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af2589de4bf5f12a", "name": "CVE-2026-2950: lodash 4.17.21 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5421cd2f526620ca", "name": "CVE-2026-4800: lodash-es 4.17.21 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash-es to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35024875a6547d68", "name": "CVE-2025-13465: lodash-es 4.17.21 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash-es to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3ec518c157b916a", "name": "CVE-2026-2950: lodash-es 4.17.21 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash-es to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-223ba901c5bb467e", "name": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "mdast-util-to-hast: mdast-util-to-hast: Markdown code elements can appear as regular page content\n\nmdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.\n\nPackage: mdast-util-to-hast\nInstalled: 13.2.0\nFixed in: 13.2.1\nSeverity: MEDIUM\nFix: Upgrade mdast-util-to-hast to 13.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62de900c36a5c5ee", "name": "CVE-2026-26996: minimatch 3.1.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45dd2bc15a23a190", "name": "CVE-2026-27903: minimatch 3.1.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-02d9231874d9890d", "name": "CVE-2026-27904: minimatch 3.1.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-88887d2146e94474", "name": "CVE-2026-67213: nanoid 3.3.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.11\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e109eaa8f28e80ad", "name": "CVE-2026-67214: nanoid 3.3.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-67214: nanoid 3.3.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.11\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac2818d0271e0523", "name": "CVE-2026-73086: nanoid 3.3.11 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-73086: nanoid 3.3.11 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 3.3.11\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f327f3c7f54205e", "name": "CVE-2024-4367: pdfjs-dist 3.11.174 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2024-4367: pdfjs-dist 3.11.174 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "Mozilla: Arbitrary JavaScript execution in PDF.js\n\nA type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.\n\nPackage: pdfjs-dist\nInstalled: 3.11.174\nFixed in: 4.2.67\nSeverity: HIGH\nFix: Upgrade pdfjs-dist to 4.2.67"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8398775014fa9bc", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf7454e7d22f3283", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfd52f3b9c2c7438", "name": "CVE-2026-45623: postcss 8.5.6 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-45623: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d215e1850484ec67", "name": "CVE-2026-73646: postcss 8.5.6 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-73646: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7dc662b97633c05c", "name": "CVE-2026-41305: postcss 8.5.6 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7781a19e3989511b", "name": "CVE-2026-69153: postcss 8.5.6 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-69153: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.5.6\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc2759b0f97dd1cd", "name": "CVE-2024-53382: prismjs 1.27.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2024-53382: prismjs 1.27.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin\n\nPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.\n\nPackage: prismjs\nInstalled: 1.27.0\nFixed in: 1.30.0\nSeverity: MEDIUM\nFix: Upgrade prismjs to 1.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-930829ac9b7d5a99", "name": "CVE-2024-53382: prismjs 1.29.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2024-53382: prismjs 1.29.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin\n\nPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.\n\nPackage: prismjs\nInstalled: 1.29.0\nFixed in: 1.30.0\nSeverity: MEDIUM\nFix: Upgrade prismjs to 1.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e334a132a24668e", "name": "CVE-2026-41242: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-41242: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 8.0.1, 7.5.5\nSeverity: CRITICAL\nFix: Upgrade protobufjs to 8.0.1, 7.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ed29d790252979e1", "name": "CVE-2026-44289: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44289: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6eeff36700d791d3", "name": "CVE-2026-44290: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44290: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4525cdd81be478fe", "name": "CVE-2026-44291: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44291: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerabilit\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc3f622ed478b6ee", "name": "CVE-2026-44293: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44293: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc15b00534c5c18b", "name": "CVE-2026-48712: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-48712: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.1, 8.4.1\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.6.1, 8.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fdac44d350a7c7d7", "name": "CVE-2026-44288: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44288: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c12aece4c78daaa4", "name": "CVE-2026-44292: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44292: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ab942ad66f81f89", "name": "CVE-2026-44294: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-44294: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c2606dcb6df9a", "name": "CVE-2026-45740: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-45740: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.8, 8.2.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.8, 8.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abce65fd1d786957", "name": "CVE-2026-54269: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-54269: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could r\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.3, 8.6.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.3, 8.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5eb2b387fde1a279", "name": "CVE-2026-59877: protobufjs 7.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-59877: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.5, 8.6.6\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.5, 8.6.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3f01f26cb4d22be", "name": "CVE-2025-15284: qs 6.13.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.13.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-375d4bf0b20e5d43", "name": "CVE-2026-82417: qs 6.13.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-82417: qs 6.13.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7340bbe99bcdb325", "name": "CVE-2026-8723: qs 6.13.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.13.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8243decf874bb362", "name": "CVE-2026-2391: qs 6.13.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.13.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65e1115aab90c3df", "name": "CVE-2021-3163: quill 1.3.7 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2021-3163: quill 1.3.7 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "Cross-site Scripting in quill\n\nA vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser\n\nPackage: quill\nInstalled: 1.3.7\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cc6e813c00ab882", "name": "CVE-2025-15056: quill 2.0.3 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-15056: quill 2.0.3 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "Quill is vulnerable to XSS via HTML export feature\n\nA lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.\n\nPackage: quill\nInstalled: 2.0.3\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67e9f53067a74c86", "name": "CVE-2025-68470: react-router 6.16.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2025-68470: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "react-router: React Router unexpected external redirect\n\nReact Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 6.30.2, 7.9.6\nSeverity: MEDIUM\nFix: Upgrade react-router to 6.30.2, 7.9.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d1e36a1cbc61fdd", "name": "CVE-2026-40181: react-router 6.16.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-40181: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "react-router: React Router: Open redirect vulnerability via specially crafted URLs\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 7.14.1, 6.30.4\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.14.1, 6.30.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccc78d24ad962ac8", "name": "CVE-2026-53666: react-router 6.16.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-53666: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "react-router: React Router: Information disclosure via client-side constructor execution\n\nReact Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 7.18.0\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef4ca5834748fa88", "name": "CVE-2026-53669: react-router 6.16.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-53669: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "react-router: React Router: Open Redirect vulnerability via backslashes in navigation components\n\nReact Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 7.18.0\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-081489eb5bcdb562", "name": "CVE-2026-59873: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-59873: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted gzip bomb\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.19\nSeverity: CRITICAL\nFix: Upgrade tar to 7.5.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-87fee689958904cf", "name": "CVE-2026-23745: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-23745: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives\n\nnode-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.3\nSeverity: HIGH\nFix: Upgrade tar to 7.5.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f33e979ca421a01e", "name": "CVE-2026-23950: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-23950: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition\n\nnode-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `\u00df` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.4\nSeverity: HIGH\nFix: Upgrade tar to 7.5.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43d2959233e37f24", "name": "CVE-2026-24842: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-24842: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check\n\nnode-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.7\nSeverity: HIGH\nFix: Upgrade tar to 7.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50e8027f69c8f06c", "name": "CVE-2026-26960: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-26960: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation\n\nnode-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.8\nSeverity: HIGH\nFix: Upgrade tar to 7.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c87b60b2faf3865c", "name": "CVE-2026-29786: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-29786: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: hardlink path traversal via drive-relative linkpath\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.10\nSeverity: HIGH\nFix: Upgrade tar to 7.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e5f5bede9ef3f59", "name": "CVE-2026-31802: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-31802: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "tar: tar: File overwrite via drive-relative symlink traversal\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.11\nSeverity: HIGH\nFix: Upgrade tar to 7.5.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14a489eae9eb3c3d", "name": "CVE-2026-59874: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-59874: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "tar: Node-tar: Denial of Service via malformed tar archive header\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.18\nSeverity: HIGH\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aecd4f0db4e462bc", "name": "CVE-2026-73566: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-73566: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted long-path tar archive\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxD\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.21\nSeverity: HIGH\nFix: Upgrade tar to 7.5.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b9afe995736a82b", "name": "CVE-2026-53655: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-53655: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing\n\nnode-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the by\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.16\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3c5eebc711b66b8", "name": "CVE-2026-59871: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-59871: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.18\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2d9036efe0223d4", "name": "CVE-2026-59875: tar 6.2.1 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-59875: tar 6.2.1 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.17\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f25ec3aa3467d069", "name": "CVE-2026-41907: uuid 13.0.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 13.0.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 13.0.0\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40af59b267e5ea94", "name": "CVE-2026-33532: yaml 1.10.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 1.10.2\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bbfb1ac530764bb", "name": "CVE-2026-33532: yaml 2.8.2 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-33532: yaml 2.8.2 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 2.8.2\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-973bcc3e14770edc", "name": "CVE-2026-49356: @babel/core 7.27.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-49356: @babel/core 7.27.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment\n\nBabel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 an\n\nPackage: @babel/core\nInstalled: 7.27.4\nFixed in: 8.0.0-rc.6, 7.29.6\nSeverity: LOW\nFix: Upgrade @babel/core to 8.0.0-rc.6, 7.29.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef92c1be66f4aec3", "name": "CVE-2025-27789: @babel/runtime 7.24.6 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-27789: @babel/runtime 7.24.6 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups\n\nBabel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, usi\n\nPackage: @babel/runtime\nInstalled: 7.24.6\nFixed in: 7.26.10, 8.0.0-alpha.17\nSeverity: MEDIUM\nFix: Upgrade @babel/runtime to 7.26.10, 8.0.0-alpha.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31def5155118a1f4", "name": "CVE-2026-54285: @opentelemetry/core 2.2.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 2.2.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 2.2.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3cc28854c64cb62", "name": "CVE-2026-54285: @opentelemetry/core 2.6.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-54285: @opentelemetry/core 2.6.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers\n\nopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerabili\n\nPackage: @opentelemetry/core\nInstalled: 2.6.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade @opentelemetry/core to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79185c0e01b569bf", "name": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: @protobufjs/utf8\nInstalled: 1.1.0\nFixed in: 1.1.1\nSeverity: MEDIUM\nFix: Upgrade @protobufjs/utf8 to 1.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f4a8120c859c604", "name": "CVE-2026-22029: @remix-run/router 1.9.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-22029: @remix-run/router 1.9.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects\n\nReact Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<\n\nPackage: @remix-run/router\nInstalled: 1.9.0\nFixed in: 1.23.2\nSeverity: HIGH\nFix: Upgrade @remix-run/router to 1.23.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9df99dc80f457fdc", "name": "CVE-2026-40181: @remix-run/router 1.9.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-40181: @remix-run/router 1.9.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "react-router: React Router: Open redirect vulnerability via specially crafted URLs\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.\n\nPackage: @remix-run/router\nInstalled: 1.9.0\nFixed in: 1.23.3\nSeverity: MEDIUM\nFix: Upgrade @remix-run/router to 1.23.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d65fafcc0f5da54", "name": "CVE-2024-39338: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2024-39338: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: axios: Server-Side Request Forgery\n\naxios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.7.4\nSeverity: HIGH\nFix: Upgrade axios to 1.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ad31cb444f48ece7", "name": "CVE-2025-27152: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-27152: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests\n\naxios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if \u2060baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.8.2, 0.30.0\nSeverity: HIGH\nFix: Upgrade axios to 1.8.2, 0.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7be4162dc16e93f2", "name": "CVE-2025-58754: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-58754: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios DoS via lack of data size check\n\nAxios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI a\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.12.0, 0.30.2\nSeverity: HIGH\nFix: Upgrade axios to 1.12.0, 0.30.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0126bc253f7eea36", "name": "CVE-2026-25639: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-25639: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d797fc4fe4e7995", "name": "CVE-2026-42033: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42033: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a76b0d40d7e415b", "name": "CVE-2026-42035: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42035: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8f8b50050e0e11d", "name": "CVE-2026-42043: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42043: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32e6563df6347343", "name": "CVE-2026-42264: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42264: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation\n\nAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.2\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c25e8b6b9729b3b0", "name": "CVE-2026-44486: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44486: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-928aea9377b6e9d3", "name": "CVE-2026-44487: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44487: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51804ca5fab4fc9b", "name": "CVE-2026-44494: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44494: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e9acf6b700bc31e", "name": "CVE-2026-44495: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44495: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6ca2f809b4d03cab", "name": "CVE-2026-44496: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44496: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-413b8eb7667e6fe0", "name": "CVE-2023-45857: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2023-45857: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: exposure of confidential data stored in cookies\n\nAn issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.6.0, 0.28.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.6.0, 0.28.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60cd5ad444b178f2", "name": "CVE-2025-62718: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-62718: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8ce6004946703a0", "name": "CVE-2026-40175: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-40175: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d30c67f988d3006", "name": "CVE-2026-42034: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42034: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faeffbbfedbf0afe", "name": "CVE-2026-42036: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42036: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf28d5c662d00c91", "name": "CVE-2026-42037: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42037: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-202f6039481a091d", "name": "CVE-2026-42038: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42038: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8370b7e43568e085", "name": "CVE-2026-42039: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42039: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e89b3f361d2b17cd", "name": "CVE-2026-42041: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42041: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bfb6a7ff8882310", "name": "CVE-2026-42042: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42042: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0175b80c3e74c2c9", "name": "CVE-2026-42044: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42044: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, \n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.2\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c29153115581a85", "name": "CVE-2026-44490: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44490: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73e0901fb7ea62da", "name": "CVE-2026-67312: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-67312: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing\n\naxios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and c\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca15646390ca05aa", "name": "CVE-2026-67313: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-67313: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios versions 0.28.0 and later contain uncontrolled recursion in form ...\n\naxios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-079ddb1925bc3271", "name": "CVE-2026-67316: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-67316: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection\n\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling export\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-787b2a1d4ee576ad", "name": "CVE-2026-67319: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-67319: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: axios: Information disclosure and data manipulation via prototype pollution\n\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited user\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4647a65a42aaaed0", "name": "CVE-2026-42040: axios 1.5.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-42040: axios 1.5.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 1.5.1\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d50144574cbea515", "name": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2468c4505dd77f1e", "name": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4253727112bb722a", "name": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-394d5f10f2d1d977", "name": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c0282388d10abaf", "name": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-160b5799dc02b0d9", "name": "CVE-2026-73088: browserslist 4.24.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-73088: browserslist 4.24.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "browserslist: Browserslist: Prototype pollution leading to denial of service\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasO\n\nPackage: browserslist\nInstalled: 4.24.4\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b5c2cc05a2d0caff", "name": "CVE-2026-73089: browserslist 4.24.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-73089: browserslist 4.24.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results\n\nBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memo\n\nPackage: browserslist\nInstalled: 4.24.4\nFixed in: 4.28.7\nSeverity: HIGH\nFix: Upgrade browserslist to 4.28.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c609d73aab45e90b", "name": "CVE-2026-24001: diff 8.0.2 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-24001: diff 8.0.2 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "jsdiff: denial of service vulnerability in parsePatch and applyPatch\n\njsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provid\n\nPackage: diff\nInstalled: 8.0.2\nFixed in: 8.0.3, 5.2.2, 4.0.4, 3.5.1\nSeverity: LOW\nFix: Upgrade diff to 8.0.3, 5.2.2, 4.0.4, 3.5.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-083a83a7c5731f96", "name": "CVE-2026-41238: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-41238: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7b40269dfe7a040", "name": "CVE-2026-41239: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-41239: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c865cd809357030", "name": "CVE-2026-41240: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-41240: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive \n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9c8e0ff8d7c0d51", "name": "CVE-2026-49458: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-49458: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45226fab682c79bb", "name": "CVE-2026-49459: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-49459: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44d6b7f150d52df3", "name": "CVE-2026-49978: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-49978: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15d67f2b9b9c0eb7", "name": "CVE-2026-65898: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-65898: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution\n\nDOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.11\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f5b7253a598db58", "name": "CVE-2026-65902: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-65902: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Sanitization bypass via hook manipulation\n\nDOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitiz\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1d851ee9dc8476d", "name": "CVE-2026-65903: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-65903: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Security bypass allows injection of malicious content\n\nDOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f45c100057eb3e2", "name": "GHSA-55q2-fjhq-7xh7: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS\n\n### Summary\n\nDuring `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onload` handler and fire after `sanitize()` returns, even though the returned root is clean and the image remains disconnected from the document.\n\n### Details\n\nIn DOMPurify 3.4.12, `_sanitizeElements()` in `src/purify.ts:1862-1904` runs the `beforeSanitizeElements` or `uponSanitizeElement` hook and returns immed\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.13\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fb7bdc08269e160", "name": "CVE-2026-65899: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-65899: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset\n\nDOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call als\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.9\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecf86cf0bae09cee", "name": "CVE-2026-65900: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-65900: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Template expression injection allows information disclosure\n\nDOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.8\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5eab2472ba887522", "name": "CVE-2026-65901: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-65901: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName\n\nDOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-519c858f90d427e3", "name": "GHSA-c2j3-45gr-mqc4: dompurify 3.3.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\n## Summary\n\nThere is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`.\n\nWhen a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it appears that the element does not go through `afterSanitizeElements` in the same way as a normal element. As a result, an application that relies on `afterSanitizeElements` as a security policy layer to strip sensitive attributes from all elements may see those attributes removed from normal elements bu\n\nPackage: dompurify\nInstalled: 3.3.3\nFixed in: 3.4.12\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d803685053983b81", "name": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.4.8\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-943aa578bd52c12c", "name": "CVE-2026-45820: fflate 0.7.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-45820: fflate 0.7.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.7.4\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00a6037652b33ee8", "name": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()\n\nVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.15.4\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c45114ffe2a4876e", "name": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "follow-redirects: Possible credential leak\n\nfollow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.15.6\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-769903f0611ac167", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 frontend/yarn.lock", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1729202193ea1bd9", "name": "CVE-2025-7783: form-data 4.0.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "form-data: Unsafe random function in form-data\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.4, 3.0.4, 4.0.4\nSeverity: CRITICAL\nFix: Upgrade form-data to 2.5.4, 3.0.4, 4.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e59024b120826607", "name": "CVE-2026-12143: form-data 4.0.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73db3e8d108ca7a5", "name": "CVE-2026-4800: lodash-es 4.17.21 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash-es to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a00781939047319", "name": "CVE-2025-13465: lodash-es 4.17.21 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash-es to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76a5dd7f48e2c56b", "name": "CVE-2026-2950: lodash-es 4.17.21 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash-es\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash-es to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3d9eb69d1cba5ff", "name": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "mdast-util-to-hast: mdast-util-to-hast: Markdown code elements can appear as regular page content\n\nmdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.\n\nPackage: mdast-util-to-hast\nInstalled: 13.2.0\nFixed in: 13.2.1\nSeverity: MEDIUM\nFix: Upgrade mdast-util-to-hast to 13.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07ffd50ccbb1423f", "name": "CVE-2026-26996: minimatch 8.0.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-26996: minimatch 8.0.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 8.0.4\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf62e8db59b6eefa", "name": "CVE-2026-27903: minimatch 8.0.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-27903: minimatch 8.0.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 8.0.4\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8464b6c7ccf6fd48", "name": "CVE-2026-27904: minimatch 8.0.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-27904: minimatch 8.0.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 8.0.4\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-87c3b1e3583c19c1", "name": "CVE-2026-67213: nanoid 3.3.7 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-674582d5071f7472", "name": "CVE-2026-67214: nanoid 3.3.7 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-67214: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c646170b588c229c", "name": "CVE-2026-73086: nanoid 3.3.7 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-73086: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid: Predictable ID generation due to integer overflow\n\nnanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" unt\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 3.3.12, 5.1.11\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.12, 5.1.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ccfc179b324abda6", "name": "CVE-2024-55565: nanoid 3.3.7 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2024-55565: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "nanoid: nanoid mishandles non-integer values\n\nnanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 5.0.9, 3.3.8\nSeverity: MEDIUM\nFix: Upgrade nanoid to 5.0.9, 3.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e1fc610f4f56fcc", "name": "CVE-2024-4367: pdfjs-dist 3.11.174 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2024-4367: pdfjs-dist 3.11.174 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "Mozilla: Arbitrary JavaScript execution in PDF.js\n\nA type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.\n\nPackage: pdfjs-dist\nInstalled: 3.11.174\nFixed in: 4.2.67\nSeverity: HIGH\nFix: Upgrade pdfjs-dist to 4.2.67"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf2df062655cf396", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5207ffe534611bc1", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9e6a259ba9d7ba2", "name": "CVE-2026-45623: postcss 8.4.41 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-45623: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.4.41\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78aa616104a967d7", "name": "CVE-2026-73646: postcss 8.4.41 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-73646: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.4.41\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8a1a3f4763c4e27a", "name": "CVE-2026-41305: postcss 8.4.41 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.41\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c4d3c05b6a0c4ae", "name": "CVE-2026-69153: postcss 8.4.41 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-69153: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.4.41\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de88864dabaa1ee1", "name": "CVE-2024-53382: prismjs 1.27.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2024-53382: prismjs 1.27.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin\n\nPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.\n\nPackage: prismjs\nInstalled: 1.27.0\nFixed in: 1.30.0\nSeverity: MEDIUM\nFix: Upgrade prismjs to 1.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-208332334a9e61dc", "name": "CVE-2024-53382: prismjs 1.29.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2024-53382: prismjs 1.29.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin\n\nPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.\n\nPackage: prismjs\nInstalled: 1.29.0\nFixed in: 1.30.0\nSeverity: MEDIUM\nFix: Upgrade prismjs to 1.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-427c4f927140a4fb", "name": "CVE-2026-41242: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-41242: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 8.0.1, 7.5.5\nSeverity: CRITICAL\nFix: Upgrade protobufjs to 8.0.1, 7.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-723f8f050e447339", "name": "CVE-2026-44289: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44289: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e32922d6ad964680", "name": "CVE-2026-44290: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44290: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46f6494e5fe8da46", "name": "CVE-2026-44291: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44291: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerabilit\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c8535860130155cd", "name": "CVE-2026-44293: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44293: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84b6b9d39be029d9", "name": "CVE-2026-48712: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-48712: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.1, 8.4.1\nSeverity: HIGH\nFix: Upgrade protobufjs to 7.6.1, 8.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9acf4934bbb3c142", "name": "CVE-2026-44288: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44288: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain \n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4365c2bbba0a22a4", "name": "CVE-2026-44292: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44292: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93a71551f7eb2cc4", "name": "CVE-2026-44294: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-44294: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated function bodies. A crafted schema or JSON descriptor could therefore cause generated encode, decode, verify, or conversion functions to fail during compilation. This vulnerability is fixed in 7.5.6 and 8.0.2.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.6, 8.0.2\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.6, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36fa288365997acd", "name": "CVE-2026-45740: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-45740: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.5.8, 8.2.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.5.8, 8.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6884d9c8e2bd4eba", "name": "CVE-2026-54269: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-54269: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could r\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.3, 8.6.0\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.3, 8.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-368a094cfd8a8c50", "name": "CVE-2026-59877: protobufjs 7.5.4 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-59877: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.\n\nPackage: protobufjs\nInstalled: 7.5.4\nFixed in: 7.6.5, 8.6.6\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.5, 8.6.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aee85d81212a2e45", "name": "CVE-2025-15284: qs 6.13.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-15284: qs 6.13.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-089e12278400bc91", "name": "CVE-2026-82417: qs 6.13.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-82417: qs 6.13.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d83804fd8a382b4a", "name": "CVE-2026-8723: qs 6.13.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-8723: qs 6.13.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6a146b08c4cfaed", "name": "CVE-2026-2391: qs 6.13.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-2391: qs 6.13.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.13.1\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e51ccb948e94902c", "name": "CVE-2021-3163: quill 1.3.7 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2021-3163: quill 1.3.7 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "Cross-site Scripting in quill\n\nA vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser\n\nPackage: quill\nInstalled: 1.3.7\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a75588aedf1bf3e", "name": "CVE-2025-15056: quill 2.0.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-15056: quill 2.0.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "Quill is vulnerable to XSS via HTML export feature\n\nA lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.\n\nPackage: quill\nInstalled: 2.0.3\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b104541ed7e07e7", "name": "CVE-2025-68470: react-router 6.16.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2025-68470: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "react-router: React Router unexpected external redirect\n\nReact Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 6.30.2, 7.9.6\nSeverity: MEDIUM\nFix: Upgrade react-router to 6.30.2, 7.9.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30d3b2e7ab0a6893", "name": "CVE-2026-40181: react-router 6.16.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-40181: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "react-router: React Router: Open redirect vulnerability via specially crafted URLs\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 7.14.1, 6.30.4\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.14.1, 6.30.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38751dc4f953e5d7", "name": "CVE-2026-53666: react-router 6.16.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-53666: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "react-router: React Router: Information disclosure via client-side constructor execution\n\nReact Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 7.18.0\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d19284278f259465", "name": "CVE-2026-53669: react-router 6.16.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-53669: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "react-router: React Router: Open Redirect vulnerability via backslashes in navigation components\n\nReact Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.\n\nPackage: react-router\nInstalled: 6.16.0\nFixed in: 7.18.0\nSeverity: MEDIUM\nFix: Upgrade react-router to 7.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22f891bcd84f8907", "name": "CVE-2026-27212: swiper 12.0.3 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-27212: swiper 12.0.3 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "Prototype pollution in swiper\n\nSwiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.pr\n\nPackage: swiper\nInstalled: 12.0.3\nFixed in: 12.1.2\nSeverity: CRITICAL\nFix: Upgrade swiper to 12.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3c64095a6bd9fba1", "name": "CVE-2026-59873: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-59873: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted gzip bomb\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.19\nSeverity: CRITICAL\nFix: Upgrade tar to 7.5.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d1fa8595bd287c92", "name": "CVE-2026-23745: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-23745: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives\n\nnode-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.3\nSeverity: HIGH\nFix: Upgrade tar to 7.5.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b73777ae6925ee8c", "name": "CVE-2026-23950: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-23950: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition\n\nnode-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `\u00df` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.4\nSeverity: HIGH\nFix: Upgrade tar to 7.5.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-61fbe17ffc29b063", "name": "CVE-2026-24842: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-24842: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check\n\nnode-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.7\nSeverity: HIGH\nFix: Upgrade tar to 7.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-89dc67af84da8cd5", "name": "CVE-2026-26960: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-26960: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation\n\nnode-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.8\nSeverity: HIGH\nFix: Upgrade tar to 7.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46778567f2d2aa72", "name": "CVE-2026-29786: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-29786: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: hardlink path traversal via drive-relative linkpath\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.10\nSeverity: HIGH\nFix: Upgrade tar to 7.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59056e019da0ed80", "name": "CVE-2026-31802: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-31802: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "tar: tar: File overwrite via drive-relative symlink traversal\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.11\nSeverity: HIGH\nFix: Upgrade tar to 7.5.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48066af2107d0813", "name": "CVE-2026-59874: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-59874: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "tar: Node-tar: Denial of Service via malformed tar archive header\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.18\nSeverity: HIGH\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b1ee595640f627f", "name": "CVE-2026-73566: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-73566: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted long-path tar archive\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxD\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.21\nSeverity: HIGH\nFix: Upgrade tar to 7.5.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-261b7eebd3db4fc3", "name": "CVE-2026-53655: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-53655: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing\n\nnode-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the by\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.16\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6a559d6b9750208", "name": "CVE-2026-59871: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-59871: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.18\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fdc570209c8b5d8", "name": "CVE-2026-59875: tar 6.2.1 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-59875: tar 6.2.1 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.17\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2408b2288e512b4", "name": "CVE-2026-41907: uuid 13.0.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-41907: uuid 13.0.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 13.0.0\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9e796e22d0a6b3d", "name": "CVE-2026-33532: yaml 1.10.2 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 1.10.2\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42a4dcb468c1e484", "name": "CVE-2026-33532: yaml 2.8.0 \u2014 frontend/yarn.lock", "shortDescription": {"text": "CVE-2026-33532: yaml 2.8.0 \u2014 frontend/yarn.lock"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 2.8.0\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6949d1a5af0f94c", "name": "CVE-2026-39406: @hono/node-server 1.19.11 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-39406: @hono/node-server 1.19.11 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "@hono/node-server: Middleware bypass via repeated slashes in serveStatic\n\n@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.\n\nPackage: @hono/node-server\nInstalled: 1.19.11\nFixed in: 1.19.13\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 1.19.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d61180658e40b586", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.js", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.11\nFixed in: 2.0.5, 1.19.15\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5, 1.19.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf88baed4c0ab032", "name": "CVE-2026-12590: body-parser 1.20.4 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 1.20.4 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 1.20.4\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e76f11af6645dc0c", "name": "CVE-2026-12590: body-parser 2.2.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 2.2.2\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c7d00ecd4533725", "name": "CVE-2026-13676: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf9d3c8a2fd7fc45", "name": "CVE-2026-16221: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dbe3625b42c71a41", "name": "CVE-2026-18446: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-18446: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority\n\nfast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applicati\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.4, 3.1.5, 4.1.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.4, 3.1.5, 4.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a1efacb48bf8253", "name": "CVE-2026-6321: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies\n\nfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.1, 2.4.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.1, 2.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac6abbd8e2d980b6", "name": "CVE-2026-6322: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.2, 2.4.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.2, 2.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d0ee4f31b5ec45ce", "name": "CVE-2026-75975: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-75975: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization\n\nfast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals co\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.5, 3.1.6, 4.1.3\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.5, 3.1.6, 4.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5a0191ca423a4391", "name": "CVE-2026-76172: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-76172: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects\n\nfast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacke\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.5, 3.1.6, 4.1.3\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.5, 3.1.6, 4.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b7350928fa1844c", "name": "CVE-2026-54290: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-54290: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8d861567596ce21", "name": "CVE-2026-39407: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-39407: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Middleware bypass via repeated slashes in serveStatic\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in \n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6ec07230630e882", "name": "CVE-2026-39408: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-39408: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Path traversal in toSSG() allows writing files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85753705b3de080e", "name": "CVE-2026-39409: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-39409: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d892a875dba360b5", "name": "CVE-2026-39410: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-39410: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-048e725ef5d1439a", "name": "CVE-2026-44455: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-44455: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a0b7816d40877fa", "name": "CVE-2026-44456: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-44456: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f85ab6d1e538f2d", "name": "CVE-2026-44457: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-44457: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b1464f4f113b129", "name": "CVE-2026-44458: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-44458: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2182437768914a70", "name": "CVE-2026-47673: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-47673: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0af79f9214c0fac", "name": "CVE-2026-47674: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-47674: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the \n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7520a6525c910cfc", "name": "CVE-2026-47675: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-47675: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed \n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-794c932c1128b106", "name": "CVE-2026-47676: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-47676: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e54600e7a6564646", "name": "CVE-2026-54286: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-54286: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae8c1a22e83a8b2e", "name": "CVE-2026-54287: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-54287: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ce4fd65cd7ef21e", "name": "CVE-2026-54288: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-54288: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edb57df13ff12116", "name": "CVE-2026-54289: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-54289: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74a524c749764a5e", "name": "CVE-2026-56761: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-56761: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nhono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.14\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1958e4f2ad18ee58", "name": "CVE-2026-59895: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-59895: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: Hono: Arbitrary markup injection via improper handling of class names in server-side rendering.\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9150f28e9f24755f", "name": "CVE-2026-59896: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-59896: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: Hono: Information disclosure due to improper context isolation in server-side rendering\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ced78e404532d402", "name": "CVE-2026-59897: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-59897: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "hono: Hono: Information disclosure due to incorrect header de-duplication in AWS API Gateway v1 adapter\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d68764d989539537", "name": "CVE-2026-69207: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-69207: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: ReDoS in CORS middleware via Access-Control-Request-Headers\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the de\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fffa5653d8ce3c7e", "name": "CVE-2026-71848: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-71848: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Algorithmic Complexity DoS in Language Middleware\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically wit\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d92132db179f5429", "name": "CVE-2026-71850: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-71850: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX \n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16147670a44d690a", "name": "CVE-2026-84363: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-84363: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing \n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76c9736bdaca213b", "name": "CVE-2026-84364: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-84364: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a reque\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ac00cbe9cf0c660", "name": "CVE-2026-84365: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-84365: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output direc\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d76c33e3f727582", "name": "GHSA-26pp-8wgv-hjvm: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono missing validation of cookie name on write path in setCookie()\n\n## Summary\n\nCookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie headers.\n\nWhile certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters.\n\nThis results in inconsistent handling of cookie names between parsing (read path) and serialization (write path).\n\n## Details\n\nWhen applications use `setCookie()`, `serialize()`, or `serializeSigned()` with a user-c\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-807b44e7d77c9e01", "name": "CVE-2026-44459: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-44459: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.18\nSeverity: LOW\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d32b47fe9f15cbef", "name": "CVE-2026-71849: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-71849: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "Hono: Proxy Helper does not remove response headers listed in the `Connection` header\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop head\n\nPackage: hono\nInstalled: 4.12.8\nFixed in: 4.12.34\nSeverity: LOW\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d78805a804a2494", "name": "CVE-2026-69192: ip-address 10.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-69192: ip-address 10.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects t\n\nPackage: ip-address\nInstalled: 10.1.0\nFixed in: 10.3.1\nSeverity: HIGH\nFix: Upgrade ip-address to 10.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d3b8072be4c69c50", "name": "CVE-2026-42338: ip-address 10.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,\n\nPackage: ip-address\nInstalled: 10.1.0\nFixed in: 10.1.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75a332aede28835f", "name": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters\n\nImpact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\n\n\nPackage: path-to-regexp\nInstalled: 0.1.12\nFixed in: 0.1.13\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf4da76dd772425d", "name": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions\n\nImpact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de07ea47602e8c44", "name": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards\n\nImpact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: MEDIUM\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f836ba4b72b823e2", "name": "CVE-2026-82417: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-82417: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.14.2\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cb6ab9bb55a304d", "name": "CVE-2026-82562: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-82562: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via array limit bypass in query string parsing\n\n### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary le\n\nPackage: qs\nInstalled: 6.14.2\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4946bcb1a8d0ea5", "name": "CVE-2026-8723: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.14.2\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7403d6789c87a159", "name": "CVE-2026-27962: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-27962: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.9\nSeverity: CRITICAL\nFix: Upgrade authlib to 1.6.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d53b0566d8fcba56", "name": "CVE-2026-28490: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-28490: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "authlib: Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements cor\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.9\nSeverity: HIGH\nFix: Upgrade authlib to 1.6.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a025c4cf45c2e99c", "name": "CVE-2026-28498: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-28498: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorit\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.9\nSeverity: HIGH\nFix: Upgrade authlib to 1.6.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be9e3b57d84e2d1a", "name": "CVE-2026-28802: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-28802: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.7\nSeverity: HIGH\nFix: Upgrade authlib to 1.6.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc82698d965a9730", "name": "CVE-2026-41425: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41425: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "authlib: Authlib: Cross-Site Request Forgery (CSRF) vulnerability in OAuth cache feature\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth.  This vulnerability is fixed in 1.6.11.\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.11\nSeverity: MEDIUM\nFix: Upgrade authlib to 1.6.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-203bf8ca0a03e3fb", "name": "CVE-2026-41479: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41479: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "authlib: Authlib: Open Redirect vulnerability via crafted authorization requests\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. \n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.10, 1.7.1\nSeverity: MEDIUM\nFix: Upgrade authlib to 1.6.10, 1.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53f0b6d4ac93bf24", "name": "CVE-2026-44681: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-44681: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Authlib is a Python library which builds OAuth and OpenID Connect serv ...\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.7.1, 1.6.12\nSeverity: MEDIUM\nFix: Upgrade authlib to 1.7.1, 1.6.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4e99c36ef2cf196", "name": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads\n\ncbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still ra\n\nPackage: cbor2\nInstalled: 5.8.0\nFixed in: 5.9.0\nSeverity: HIGH\nFix: Upgrade cbor2 to 5.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91d7639be26dfbd9", "name": "CVE-2026-45829: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45829: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection\n\nA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the\u00a0/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: CRITICAL\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a27b67a1f3e51376", "name": "CVE-2026-45833: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45833: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "chromadb: ChromaDB: Arbitrary Code Execution via Code Injection\n\nA code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the\u00a0/api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: CRITICAL\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9fd8799991f16907", "name": "CVE-2026-45830: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45830: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "chromadb: ChromaDB: Unauthorized data manipulation due to improper authorization validation\n\nA lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d0c0257ecda4e44", "name": "CVE-2026-45831: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45831: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "ChromaDB: ChromaDB: Unauthorized cross-tenant actions due to improper authorization checks\n\nThe SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c315f20d266ae4c7", "name": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outco\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 50.0.0\nSeverity: HIGH\nFix: Upgrade cryptography to 50.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e40d5da0911617ec", "name": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building\n\npython-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 49.0.0\nSeverity: HIGH\nFix: Upgrade cryptography to 49.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7087e35e26afea4c", "name": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Vulnerable OpenSSL included in cryptography wheels\n\npyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on \n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 48.0.1\nSeverity: HIGH\nFix: Upgrade cryptography to 48.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-170fe4b16465570a", "name": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 46.0.7\nSeverity: MEDIUM\nFix: Upgrade cryptography to 46.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb35fa0ce026e14c", "name": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted con\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 49.0.0\nSeverity: MEDIUM\nFix: Upgrade cryptography to 49.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbe40610e7e0697d", "name": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for b\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 46.0.6\nSeverity: LOW\nFix: Upgrade cryptography to 46.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20c1ef61acc332dc", "name": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django SQL injection\n\nAn issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.8, 5.1.14, 4.2.26\nSeverity: CRITICAL\nFix: Upgrade django to 5.2.8, 5.1.14, 4.2.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-15b84f37dbab6617", "name": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django SQL injection in FilteredRelation column aliases\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.24, 5.1.12, 5.2.6\nSeverity: HIGH\nFix: Upgrade django to 4.2.24, 5.1.12, 5.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23a09a6d76d6c4a0", "name": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB1\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.25, 5.1.13, 5.2.7\nSeverity: HIGH\nFix: Upgrade django to 4.2.25, 5.1.13, 5.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-851da6c6f6a82f49", "name": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Django: Denial-of-service vulnerability in Django on Windows\n\nAn issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may al\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.8, 5.1.14, 4.2.26\nSeverity: HIGH\nFix: Upgrade django to 5.2.8, 5.1.14, 4.2.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7d2a7e8d44d1482c", "name": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django: SQL injection in FilteredRelation column aliases\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\n`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.9, 5.1.15, 4.2.27\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.9, 5.1.15, 4.2.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cef6398b30412d43", "name": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django StripTags Denial of Service\n\nAn issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.21, 5.1.9, 5.2.1\nSeverity: MEDIUM\nFix: Upgrade django to 4.2.21, 5.1.9, 5.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3cde8d21bfb943ba", "name": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django Path Injection Vulnerability\n\nAn issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.2, 5.1.10, 4.2.22\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.2, 5.1.10, 4.2.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6353bcbfc6d3e299", "name": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.9, 5.1.15, 4.2.27\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.9, 5.1.15, 4.2.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0435ec19c74f6f41", "name": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django: Information disclosure via heap buffer over-read in GDALRaster\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5447b3ba00b772bc", "name": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django: HTTP header injection via DomainNameValidator accepting newlines\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\n\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0126b8bd6388f0bf", "name": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Potential partial directory-traversal via archive.extract()\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.25, 5.1.13, 5.2.7\nSeverity: LOW\nFix: Upgrade django to 4.2.25, 5.1.13, 5.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-817e12c2a2986bab", "name": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django: Information disclosure via improper handling of Vary header whitespace\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to than\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c63fffa78edf8d7", "name": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "django: Django: Information disclosure due to improper caching of Set-Cookie responses\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: LOW\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf0f07d93ef19ac8", "name": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-django: Django: Information disclosure via non-injective cookie salt derivation\n\nAn issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affec\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-098ba5400736285e", "name": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Django: Django: Information disclosure due to improper handling of Cache-Control directives\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank A\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce6293677cb294b9", "name": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "djangorestframework: Django REST framework: Denial of Service via oversized request bodies\n\nDjango REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.\n\nPackage: djangorestframework\nInstalled: 3.16.1\nFixed in: 3.17.2\nSeverity: MEDIUM\nFix: Upgrade djangorestframework to 3.17.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b572698a12b14e4", "name": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "djangorestframework: Django REST framework: Information disclosure via improper permission checks in AdminRenderer\n\nDjango REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.\n\nPackage: djangorestframework\nInstalled: 3.16.1\nFixed in: 3.17.2\nSeverity: MEDIUM\nFix: Upgrade djangorestframework to 3.17.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-daec31f7679e7ab0", "name": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-ecdsa: vulnerable to the Minerva attack\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-adcda7a751ff5b19", "name": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-ecdsa: ecdsa: Denial of Service via crafted DER input\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the ava\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: 0.19.2\nSeverity: MEDIUM\nFix: Upgrade ecdsa to 0.19.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5da4eba8f1d9edd", "name": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic\n\nGranian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.\n\nPackage: granian\nInstalled: 2.6.1\nFixed in: 2.7.4\nSeverity: HIGH\nFix: Upgrade granian to 2.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a1460fdbe10e0d1", "name": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Granian vulnerable to DoS via WSGI response header panic\n\nGranian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.\n\nPackage: granian\nInstalled: 2.6.1\nFixed in: 2.7.4\nSeverity: MEDIUM\nFix: Upgrade granian to 2.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e9b32e9e827d05b", "name": "CVE-2026-71554: h2 4.3.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-71554: h2 4.3.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "h2: h2: Request smuggling due to duplicate Host headers\n\nh2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.\n\nPackage: h2\nInstalled: 4.3.0\nFixed in: 4.4.1\nSeverity: MEDIUM\nFix: Upgrade h2 to 4.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d25641225374430", "name": "CVE-2026-45409: idna 3.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45409: idna 3.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-idna: idna: Denial of Service via specially crafted long inputs\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.11\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c0f88b876575685", "name": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS\n\n## Circular JSON Schema `$ref` causes unbounded CPU DoS in `json_repair`\n\n### Summary\n\n`SchemaRepairer.resolve_schema()` in `json_repair` follows JSON Schema `$ref` pointers in an unbounded `while` loop without any cycle detection. An attacker who can supply a schema containing a self-referencing `$ref` (e.g., via the demo Flask API or any application that passes untrusted input to `loads(..., schema=...)`), can cause a worker process to spin indefinitely on CPU, resulting in a complete denial o\n\nPackage: json-repair\nInstalled: 0.55.0\nFixed in: 0.60.1\nSeverity: HIGH\nFix: Upgrade json-repair to 0.60.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47ca8c308856efb4", "name": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langsmith-sdk-python: langsmith-sdk-js: LangSmith Client SDKs: Information disclosure via untrusted prompt deserialization\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langchain\nInstalled: 0.3.27\nFixed in: 0.3.30\nSeverity: HIGH\nFix: Upgrade langchain to 0.3.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7365b4b83b8e1c4", "name": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- \n\nPackage: langchain\nInstalled: 0.3.27\nFixed in: 1.3.9\nSeverity: MEDIUM\nFix: Upgrade langchain to 1.3.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9877a9ee34dff1f3", "name": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langchain: path traversal in legacy load_prompt functions in langchain-core\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension chec\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.2.22\nSeverity: HIGH\nFix: Upgrade langchain-core to 1.2.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dfca5ce7e748f697", "name": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=\"all\". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime path\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.3.3, 0.3.85\nSeverity: HIGH\nFix: Upgrade langchain-core to 1.3.3, 0.3.85"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af415482b00ba536", "name": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langchain: incomplete f-string validation in prompt templates\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate t\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 0.3.84, 1.2.28\nSeverity: MEDIUM\nFix: Upgrade langchain-core to 0.3.84, 1.2.28"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aaf556935fc094a8", "name": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langchain: SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.2.11\nSeverity: LOW\nFix: Upgrade langchain-core to 1.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1f4f692f76f8ff7", "name": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters\n 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The resp\n\nPackage: langchain-text-splitters\nInstalled: 0.3.11\nFixed in: 1.1.2\nSeverity: MEDIUM\nFix: Upgrade langchain-text-splitters to 1.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-724d7e90aa2c54c7", "name": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "langsmith-sdk-python: langsmith-sdk-js: LangSmith Client SDKs: Information disclosure via untrusted prompt deserialization\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.8.0\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c84e7f9cf4f98d6", "name": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read\n\n# Summary\n\nAn attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a pa\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.8.18\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da055c4ad365ccc8", "name": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LangSmith SDK: Streaming token events bypass output redaction\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.7.31\nSeverity: MEDIUM\nFix: Upgrade langsmith to 0.7.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22ffadb0ac722f70", "name": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cach\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8e5544e96dd18b17", "name": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\n\nBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-69aea02219862dbb", "name": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication Bypass via Host Header Injection\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route fro\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2ebedd8d33a8c056", "name": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetchin\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-723adbfa8f7b9fc5", "name": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting\n\nLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-19d5390162a4cac9", "name": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ceec67e294922a5a", "name": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it \u2014 POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list \u2014 accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied com\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03c765f698b35d17", "name": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Privilege escalation via API key generation with insufficient permission validation\n\nLiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.14\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a8138a3574a9010", "name": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Privilege escalation through user role modification\n\nLiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-05e6204484ba6e5a", "name": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Unauthorized access due to authentication bypass\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60a762076e69252b", "name": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass\n\n### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35a5df3e4858b498", "name": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function\n\nA weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-590d825e9b615d3f", "name": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Missing authentication in SSO Debug Flow allows remote access.\n\nA vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfce18fc6f4b306e", "name": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Directory traversal via crafted skill archive upload\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-868991f781ed961e", "name": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.9\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.83.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0528578b60a4d9a3", "name": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: Litellm: Improper authorization vulnerability\n\nA vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7dbdb4f3c3a78eb", "name": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Session expiration leading to denial of service\n\nA security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a133fe1ffe9574b", "name": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: litellm: Session expiration vulnerability in SSO Authentication Flow\n\nA vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c201bc42c816beab", "name": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Incorrect authorization via prompt manipulation\n\nA security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d3d0e2636870bdc", "name": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Server-Side Request Forgery via spec_path argument manipulation\n\nA weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early abou\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d15e5c4e05bc0a3", "name": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Information Disclosure via improper authorization in ui_view_users function\n\nA security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-528241251767bf24", "name": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Information disclosure via local file read in test connection endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: LOW\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8936c00394f8c33", "name": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.82.0\nSeverity: LOW\nFix: Upgrade litellm to 1.82.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7630e0de561cb6d7", "name": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read\n\nlxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.\n\nPackage: lxml\nInstalled: 6.0.2\nFixed in: 6.1.0\nSeverity: HIGH\nFix: Upgrade lxml to 6.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-26df05ff8a822ee1", "name": "CVE-2026-41205: mako 1.3.10 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41205: mako 1.3.10 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "mako: Mako: Information disclosure via path traversal vulnerability\n\nMako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.\n\nPackage: mako\nInstalled: 1.3.10\nFixed in: 1.3.11\nSeverity: HIGH\nFix: Upgrade mako to 1.3.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e8eecdd8c52db21", "name": "CVE-2026-44307: mako 1.3.10 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-44307: mako 1.3.10 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "mako: Mako: Information disclosure via directory traversal\n\nMako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.\n\nPackage: mako\nInstalled: 1.3.10\nFixed in: 1.3.12\nSeverity: HIGH\nFix: Upgrade mako to 1.3.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39b3fc43bd0ae4bf", "name": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.27.2\nSeverity: HIGH\nFix: Upgrade mcp to 1.27.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2acf0c78b6b05b0", "name": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.27.2\nSeverity: HIGH\nFix: Upgrade mcp to 1.27.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b44ade8353ff5370", "name": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.28.1\nSeverity: HIGH\nFix: Upgrade mcp to 1.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab6c60b6ae48890b", "name": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error\n\n### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct da\n\nPackage: msgpack\nInstalled: 1.1.2\nFixed in: 1.2.1\nSeverity: HIGH\nFix: Upgrade msgpack to 1.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91d076a985aa77d5", "name": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: Zip Slip Vulnerability in nltk Leading to Code Execution\n\nA critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e1a1aa198aa53152", "name": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pick ...\n\nNLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code wit\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e2312811de055e4b", "name": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "NLTK versions before 3.10.3 contain a remote code execution vulnerabil ...\n\nNLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-bb2238de44b55cbb", "name": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0361d4041c41434c", "name": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary Code Execution via Eval Injection in Collocations Module\n\nNLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lo\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5c441bf57f7797f9", "name": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function\n\nA vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept u\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b72090d3ff09e890", "name": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via path traversal vulnerability\n\nA vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly critical in scenarios where user-controlled file inputs are processed, such as in machine learning APIs\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b11b7d5783150482", "name": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex\n\n### Summary\n`ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit (e.g. a label then `[+2]`) from each review line, using the module-level `FEATURES` regex. The feature-label sub-pattern is unbounded \u2014 an optional greedy run of word-plus-whitespace groups followed by another word, which must then be followed by a literal `[`. On a long bracket-less line the label can match from every search position to the end of the line, causing quadratic b\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-395e920b9763704a", "name": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)\n\n### Summary\n   A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can\n   influence the `fileids` argument of its public read methods (`header`, `raw`,\n   `words`, `sents`, `tagged_words`) to read files outside the corpus root. The\n   reader builds the file path with no containment check and opens it with the\n   builtin `open()`, so it bypasses NLTK's `nltk.pathsec` sandbox \u2014 including the\n   strict `ENFORCE = True` mode that `SECURITY.md` recommends for web/multi-tenant\n\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25988f0e9cfe6f00", "name": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)\n\n### Summary\n`FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is read with the builtin `open()`, bypassing `CorpusReader.open()` and the `nltk.pathsec` sandbox \u2014 including strict `ENFORCE=True` mode. A `../` sequence in the name escapes the corpus root, yielding an arbitrary XML file read whose parsed content is returned to the caller.\n\n\n### Details\n`frame_by_name` builds the path by joining the corpus root, the frame directory, and the calle\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85e369860d142bbf", "name": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode\n\n### Summary\n`nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict `ENFORCE` mode for security-sensitive environments. The filter is bypassable by DNS rebinding: `validate_network_url()` resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d076408a1b334699", "name": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unauthenticated remote shutdown\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-984bdbf134029e7f", "name": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file c\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8a8d2dc541923377", "name": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information Disclosure via Path Traversal in `nltk.data.load()`\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to by\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9824cedaee214cbf", "name": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure through path traversal\n\nNLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e92ba1a528f8c20", "name": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "NLTK: NLTK: Bypass of path traversal and pickle deserialization protections due to insecure default configuration\n\nNLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea177af24fde223d", "name": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via StreamBackedCorpusView bypass\n\nNLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f533634ac42a7952", "name": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via symlink escape in CorpusReader.open()\n\nNLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b9ecec1573feb38", "name": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK TweetTokenizer: Denial of Service via crafted URL input\n\nThe URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.1\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e6a3c2a74e2a0104", "name": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "NLTK versions before 3.10.3 fail to use validated absolute paths when  ...\n\nNLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5aefd0c121756629", "name": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in  ...\n\nNLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4434400848423c2f", "name": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration\n\nNLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an \n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36e27e0febd6bab9", "name": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors\n\nNLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-527e096dc343b364", "name": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via path traversal with symlink bypass\n\nNLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d53399ab88ce2e23", "name": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unvalidated regular expressions\n\nNLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f5cdb9713b14e6c", "name": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service vulnerability in tgrep module\n\nNLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing i\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91178a847a302876", "name": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Unauthorized file access via path traversal in model-artifact APIs\n\nNLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fbab559305a32fc2", "name": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation\n\nIn nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content be\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9ef0765b5561f78", "name": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars\n\n`nltk.parse.RecursiveDescentParser` (and `SteppingRecursiveDescentParser`) enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU (and/or exhaust the Python recursion stack), pinning a process indefinitely \u2014 a denial of service.\n\n## Proof of concept\n\nBoth of the following hang on a 24-token input (killed after 8s; growth is super-linear in input length), on NLTK develop:\n\n```python\nfrom nltk import\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ecb0427ace2a2b0", "name": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` contains a reflected cross-site scripting issue in the `lookup_...` route. A crafted `lookup_<payload>` URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled `word` data is reflected into HTML without escaping. This impacts users running the l\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-250b9fb4dc974dca", "name": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Server-Side Request Forgery bypass via DNS resolution failures\n\nNLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebin\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d69b1bb6fc20aa32", "name": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read due to logic bug in FileSystemPathPointer\n\nNLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2be0d410dc7196a", "name": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unbounded recursion in JSONTaggedDecoder\n\nNLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6af0e2f08dea5039", "name": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing\n\nnltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causin\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b65c4e0326e54748", "name": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via malformed XML corpus files\n\nNLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d4a1ff3d7f7748f", "name": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via Uncontrolled Recursion\n\nNLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6a33bad7b21e976", "name": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks\n\nNLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-648b0efa6be911ad", "name": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Filesystem containment bypass allows local file overwrite\n\nNLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17fc94d08c24200e", "name": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "orjson: orjson: Denial of Service due to unbounded recursion with deeply nested JSON documents\n\nThe orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.\n\nPackage: orjson\nInstalled: 3.11.5\nFixed in: 3.11.6\nSeverity: HIGH\nFix: Upgrade orjson to 3.11.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63c2c6b2a72d8517", "name": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image\n\nPillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.1.1\nSeverity: HIGH\nFix: Upgrade pillow to 12.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-88ab219e4bde63cc", "name": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-634e445bf858711d", "name": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing\n\nPillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b66b3344033fe00", "name": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image\n\nPillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d8a6875cb92855b", "name": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5408e642682665bd", "name": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-837457bd0f047b72", "name": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4d2c3191b3919703", "name": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-445be665272ba1f3", "name": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Native heap out-of-bounds write\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ccd3b15c90bdc43", "name": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c201f0b8c17cdb13", "name": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of service via crafted PDF stream\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d5afdf2436bf7044", "name": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2187c8a997481b45", "name": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5401493967d6bca8", "name": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing\n\nPillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21babde5e19d13a2", "name": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via specially crafted coordinate input\n\nPillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81b1c5f86e542027", "name": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via malicious PDF processing\n\nPillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-053425802a7e5677", "name": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths\n\nPillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad583960fd9ee56f", "name": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read\n\nPillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4111400be3e481a", "name": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted EPS file\n\nPillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d82e4329eb98050f", "name": "CVE-2026-25087: pyarrow 22.0.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-25087: pyarrow 22.0.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files\n\nUse After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shar\n\nPackage: pyarrow\nInstalled: 22.0.0\nFixed in: 23.0.1\nSeverity: HIGH\nFix: Upgrade pyarrow to 23.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb4950ae866d9e64", "name": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.2\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15cf9a3281644c2f", "name": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with \"Indefinite Length\" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consu\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.3\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af51cdfb472a5ed7", "name": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pyasn1: pyasn1: Denial of Service via crafted BER input\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is f\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-117aaac109e590bc", "name": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values.\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9656462a1ca03a86", "name": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d5d06bc37cf6116c", "name": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size\n\n### Summary\n\n`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing **outside** `secrets_dir` is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented `secrets_dir_max_size` protection. An attacker or lower-privileged component able to influence entries in the configured secrets dire\n\nPackage: pydantic-settings\nInstalled: 2.12.0\nFixed in: 2.14.2\nSeverity: MEDIUM\nFix: Upgrade pydantic-settings to 2.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1e154b4cf0469b1", "name": "CVE-2026-4539: pygments 2.19.2 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer\n\nA security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nPackage: pygments\nInstalled: 2.19.2\nFixed in: 2.20.0\nSeverity: LOW\nFix: Upgrade pygments to 2.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bed10fa5c02e42b7", "name": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.12.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-072b71ffaafe0324", "name": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4fde1b0702434209", "name": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parame\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-075ddca747b7aa7b", "name": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access\n\nPyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, adv\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3c0da1b3f6f7835", "name": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens\n\nPyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bc28a467f6455b3", "name": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint be\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9284009d31987ab9", "name": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.2\nSeverity: HIGH\nFix: Upgrade pypdf to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0774ce131821c128", "name": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF inline image\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.1\nSeverity: HIGH\nFix: Upgrade pypdf to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c34f59d7c2844d1", "name": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf Infinite Loop when processing outlines/bookmarks\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.6.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23eeb2e77407944a", "name": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with TreeObject outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4860ae414739a133", "name": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large font values\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a090a6ca71ab747", "name": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-111d18779f92f6de", "name": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b99886cd183df83e", "name": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.4\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d7e8a32a588616d", "name": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.5\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e962dfff4d4d432", "name": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.8.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85549acd28243908", "name": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.9.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da384d1eb11684b6", "name": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.9.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcb651c55c7f3a31", "name": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata\n\npypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad8837f1e89450e6", "name": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with oversized streams\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ec224d2f162f130", "name": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0b3885715c47c03", "name": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a7b8d671afc99bf", "name": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large image sizes\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e965a744bfde0327", "name": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large character offsets\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32c88eeb86a804f5", "name": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2e803135b60f400", "name": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d4eeaea3b5a303a", "name": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52e54c6ad584504a", "name": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-554bf8d98e5e7d96", "name": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e116478357f8319", "name": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c47e72e8728da1d", "name": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-555e7673b0b78204", "name": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35760ec505a18d22", "name": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Possible large memory usage for wrong image dimensions\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d460b307fb7d9c0", "name": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large CID font width ranges\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-154e75a47240cae3", "name": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large /ToUnicode streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ef5b7b2ccf955fd", "name": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via inefficient handling of non-whitespace inputs\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9f04b09ac40e333", "name": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with cyclic tree structure\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1c9891077c0dcf4", "name": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d04276e4427ff82", "name": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF XForm objects\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6961902a15408cc0", "name": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: Missing stream length values ignore defined limits\n\n### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value.\n\n### Patches\nThis has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3).\n\n### Workarounds\nIf you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-650ff91903f80600", "name": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.2\nSeverity: LOW\nFix: Upgrade pypdf to 6.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1692494c7e30d789", "name": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following\n\npython-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.\n\nPackage: python-dotenv\nInstalled: 1.2.1\nFixed in: 1.2.2\nSeverity: MEDIUM\nFix: Upgrade python-dotenv to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-082a038ab97e8c9c", "name": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "requests: Requests: Security bypass due to predictable temporary file creation\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner\n\nPackage: requests\nInstalled: 2.32.5\nFixed in: 2.33.0\nSeverity: MEDIUM\nFix: Upgrade requests to 2.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6a782f6b1323c9f", "name": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)\n\nsetuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.\n\nPackage: setuptools\nInstalled: 80.9.0\nFixed in: 83.0.0\nSeverity: MEDIUM\nFix: Upgrade setuptools to 83.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b9c488592842363", "name": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-690aec8f44237416", "name": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fi\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4252e51b0f08b289", "name": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quad\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.9.0\nSeverity: MEDIUM\nFix: Upgrade soupsieve to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b1d04ea0a9326cf", "name": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits b\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.9.0\nSeverity: MEDIUM\nFix: Upgrade soupsieve to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a354ea7c22faa90c", "name": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d16450b912701dab", "name": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via inefficient SQL parsing\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3fdbb73fda3a53ff", "name": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18d6f5b616fbcdbe", "name": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Arbitrary code execution via unescaped backslashes in generated snippets\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: MEDIUM\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-273cbd8c25d51321", "name": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0. ...\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing r\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: MEDIUM\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-711a65b9b9ed16d3", "name": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.1.0\nSeverity: HIGH\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50f1e3a0f4040205", "name": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\n\nStarlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.3.1\nSeverity: HIGH\nFix: Upgrade starlette to 1.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e23d135136ca0a1", "name": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) \n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15783a39eb247ace", "name": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.1.0\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0d8ff758e8b282d", "name": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure due to improper HTTP request path validation\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header \n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade starlette to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5845b4b018a3978", "name": "CVE-2025-3000: torch 2.11.0 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2025-3000: torch 2.11.0 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "A vulnerability classified as critical has been found in PyTorch 2.6.0 ...\n\nA vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.11.0\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade torch to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3678b0900e40a50", "name": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "tornado-python: Tornado: Denial of Service via large multipart bodies\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-097f09fe79f0ed48", "name": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments\n\nIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1d048eee5c63ed5", "name": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-70fb25e44c152b9a", "name": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d9893a7e7ed15e60", "name": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Tornado is a Python web framework and asynchronous networking library. ...\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronous\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.8\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39177168b4f2de5e", "name": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Tornado has incomplete validation of cookie attributes\n\nValues passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3378d11e59c11396", "name": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)\n\n## Description\n\n### Summary\n\n`parse_multipart_form_data` (httputil.py:34) calls\n`data.split(b\"--\"+boundary+b\"\\r\\n\")` **before** the `max_parts` check (:35).\nA 600KB body with 100k parts creates a 100k-element transient list first,\nthen rejects   transient memory amplification (each split element is a copy).\nPre-auth HTTP DoS.\n\n### Root cause\n\n```python\nparts = data[:final_boundary_index].split(b\"--\" + boundary + b\"\\r\\n\")  # :34  huge list first\nif len(parts) > config.max_parts:                  \n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.8\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afacbcacf5a93844", "name": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n# CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n## Summary\n\n`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does\nnot reset them between requests, and several per-request options are applied with\nno clearing branch. As a result, sensitive state set by one request persists onto\na later request on the same client that does not set it. Two credential vectors\nare demonstrated below \u2014 a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy\nbasic-auth cr\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.7\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7682be8a112b7843", "name": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: LOW\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2f945968f98fb1e", "name": "CVE-2026-4372: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-4372: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "HuggingFace transformers vulnerable to remote code execution\n\nA critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's re\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.3.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c07b15790e48b907", "name": "CVE-2026-5241: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-5241: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting\n\nA vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `Lig\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.5.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e4fd6ad9ea1c983", "name": "CVE-2026-9856: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-9856: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "Transformers save_pretrained path traversal allows arbitrary file writes through chat template names\n\nA vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads a\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.10.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c854e481772871c", "name": "CVE-2026-1839: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt", "shortDescription": {"text": "CVE-2026-1839: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0abc72491e6191db", "name": "CVE-2024-56201: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-56201: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "jinja2: Jinja has a sandbox breakout through malicious filenames\n\nJinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications \n\nPackage: Jinja2\nInstalled: 3.1.4\nFixed in: 3.1.5\nSeverity: MEDIUM\nFix: Upgrade Jinja2 to 3.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b2b5506ee3cd3df", "name": "CVE-2024-56326: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-56326: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "jinja2: Jinja has a sandbox breakout through indirect reference to format method\n\nJinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch\n\nPackage: Jinja2\nInstalled: 3.1.4\nFixed in: 3.1.5\nSeverity: MEDIUM\nFix: Upgrade Jinja2 to 3.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e03e26b3869e24b", "name": "CVE-2025-27516: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-27516: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "jinja2: Jinja sandbox breakout through attr filter selecting format method\n\nJinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does c\n\nPackage: Jinja2\nInstalled: 3.1.4\nFixed in: 3.1.6\nSeverity: MEDIUM\nFix: Upgrade Jinja2 to 3.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e119cdbb7511b856", "name": "CVE-2025-68146: filelock 3.15.4 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-68146: filelock 3.15.4 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "filelock: filelock: Time-of-Check-Time-of-Use (TOCTOU) race condition and symlink attack allows arbitrary file corruption or truncation\n\nfilelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow\n\nPackage: filelock\nInstalled: 3.15.4\nFixed in: 3.20.1\nSeverity: MEDIUM\nFix: Upgrade filelock to 3.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d89300de6578df4", "name": "CVE-2026-22701: filelock 3.15.4 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-22701: filelock 3.15.4 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock\n\nfilelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission c\n\nPackage: filelock\nInstalled: 3.15.4\nFixed in: 3.20.3\nSeverity: MEDIUM\nFix: Upgrade filelock to 3.20.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce1940c364468e61", "name": "CVE-2024-1135: gunicorn 21.2.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-1135: gunicorn 21.2.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers\n\nGunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This \n\nPackage: gunicorn\nInstalled: 21.2.0\nFixed in: 22.0.0\nSeverity: HIGH\nFix: Upgrade gunicorn to 22.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e101b1218658b57b", "name": "CVE-2024-6827: gunicorn 21.2.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-6827: gunicorn 21.2.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "gunicorn: HTTP Request Smuggling in benoitc/gunicorn\n\nGunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.\n\nPackage: gunicorn\nInstalled: 21.2.0\nFixed in: 22.0.0\nSeverity: HIGH\nFix: Upgrade gunicorn to 22.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6ed9866290529c7a", "name": "CVE-2026-45409: idna 3.8 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-45409: idna 3.8 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-idna: idna: Denial of Service via specially crafted long inputs\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.8\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd9b95fc7138c2b7", "name": "CVE-2026-25990: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-25990: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image\n\nPillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.1.1\nSeverity: HIGH\nFix: Upgrade pillow to 12.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd26b22d34f7ecba", "name": "CVE-2026-40192: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-40192: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf7722d873960973", "name": "CVE-2026-42311: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-42311: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing\n\nPillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5c499982dedb94dc", "name": "CVE-2026-54058: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-54058: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image\n\nPillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a67c85d67ca57fd9", "name": "CVE-2026-54059: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-54059: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3294fa4ea4dd6888", "name": "CVE-2026-54060: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-54060: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e0d61efdbffcf15", "name": "CVE-2026-55379: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-55379: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e1f31d0e9bacfcb", "name": "CVE-2026-55380: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-55380: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a68dd50c6189d0e3", "name": "CVE-2026-59197: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-59197: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Native heap out-of-bounds write\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47cf2774ed636c0a", "name": "CVE-2026-59199: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-59199: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-76d5056aa692d7ee", "name": "CVE-2026-59200: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-59200: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of service via crafted PDF stream\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea11d4c1d3206ba9", "name": "CVE-2026-59204: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-59204: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6fd415671af1ae98", "name": "CVE-2026-59205: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-59205: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27e9b44173cdc7ca", "name": "CVE-2026-42308: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-42308: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing\n\nPillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30aa63b634d53065", "name": "CVE-2026-42310: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-42310: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via malicious PDF processing\n\nPillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e8286345f688dbc", "name": "CVE-2026-55798: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-55798: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths\n\nPillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb70a4c581553996", "name": "CVE-2026-59198: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-59198: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read\n\nPillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 10.4.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b200ea1771643139", "name": "CVE-2026-28684: python-dotenv 1.0.1 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-28684: python-dotenv 1.0.1 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following\n\npython-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.\n\nPackage: python-dotenv\nInstalled: 1.0.1\nFixed in: 1.2.2\nSeverity: MEDIUM\nFix: Upgrade python-dotenv to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05d4aff77880e958", "name": "CVE-2024-47081: requests 2.32.3 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-47081: requests 2.32.3 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs\n\nRequests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.\n\nPackage: requests\nInstalled: 2.32.3\nFixed in: 2.32.4\nSeverity: MEDIUM\nFix: Upgrade requests to 2.32.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f573292fddcef0e2", "name": "CVE-2026-25645: requests 2.32.3 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-25645: requests 2.32.3 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "requests: Requests: Security bypass due to predictable temporary file creation\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner\n\nPackage: requests\nInstalled: 2.32.3\nFixed in: 2.33.0\nSeverity: MEDIUM\nFix: Upgrade requests to 2.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3e706ae496b321a", "name": "CVE-2025-62727: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-62727: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette DoS via Range header merging\n\nStarlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial\u2011of\u2011service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.\n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 0.49.1\nSeverity: HIGH\nFix: Upgrade starlette to 0.49.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec17101f3a252f40", "name": "CVE-2026-48818: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-48818: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas\n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 1.1.0\nSeverity: HIGH\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dea9cfde836c65b7", "name": "CVE-2026-54283: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-54283: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\n\nStarlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 1.3.1\nSeverity: HIGH\nFix: Upgrade starlette to 1.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b6ecfb6129c730c", "name": "CVE-2025-54121: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-54121: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette denial-of-service\n\nStarlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me\n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 0.47.2\nSeverity: MEDIUM\nFix: Upgrade starlette to 0.47.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b85947a88793d1c", "name": "CVE-2026-48710: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-48710: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) \n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80f70973b8f9bb93", "name": "CVE-2026-48817: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-48817: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo\n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 1.1.0\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0da9c133322a0b88", "name": "CVE-2026-54282: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-54282: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure due to improper HTTP request path validation\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header \n\nPackage: starlette\nInstalled: 0.46.2\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade starlette to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71efbf79691f7288", "name": "CVE-2025-2998: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-2998: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability was found in PyTorch 2.6.0. It has been declared as cr ...\n\nA vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56cc3a6f618b4ea3", "name": "CVE-2025-2999: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-2999: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability was found in PyTorch 2.6.0. It has been rated as criti ...\n\nA vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: 2.9.1\nSeverity: MEDIUM\nFix: Upgrade torch to 2.9.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bd0075916a81a2a", "name": "CVE-2025-3730: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3730: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability, which was classified as problematic, was found in PyT ...\n\nA vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a pa\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: 2.8.0\nSeverity: MEDIUM\nFix: Upgrade torch to 2.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-116075301bf939a1", "name": "CVE-2025-2148: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-2148: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared ...\n\nA vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b90a0d2360244f8c", "name": "CVE-2025-2149: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-2149: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as ...\n\nA vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b86ec1d6bd95a0b1", "name": "CVE-2025-2953: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-2953: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "torch: PyTorch torch.mkldnn_max_pool2d denial of service\n\nA vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: 2.7.1-rc1\nSeverity: LOW\nFix: Upgrade torch to 2.7.1-rc1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cde514b8f0de928d", "name": "CVE-2025-3000: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3000: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability classified as critical has been found in PyTorch 2.6.0 ...\n\nA vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade torch to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fe9dffb8d4f514b", "name": "CVE-2025-3001: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3001: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "A vulnerability classified as critical was found in PyTorch 2.6.0. Thi ...\n\nA vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.6.0\nFixed in: 2.10.0\nSeverity: LOW\nFix: Upgrade torch to 2.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d92f975e6863b69", "name": "CVE-2024-11392: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-11392: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability\n\nHugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-sup\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.48.0\nSeverity: HIGH\nFix: Upgrade transformers to 4.48.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-248b5a60283c417b", "name": "CVE-2024-11393: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-11393: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability\n\nHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplie\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.48.0\nSeverity: HIGH\nFix: Upgrade transformers to 4.48.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab7f70275eae5498", "name": "CVE-2024-11394: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-11394: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability\n\nHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied dat\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.48.0\nSeverity: HIGH\nFix: Upgrade transformers to 4.48.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d0b8a7fcb06ea67", "name": "CVE-2026-4372: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-4372: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "HuggingFace transformers vulnerable to remote code execution\n\nA critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's re\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 5.3.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bedd36bd0645c04f", "name": "CVE-2026-5241: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-5241: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting\n\nA vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `Lig\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 5.5.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-86c4f81eb3b15a66", "name": "CVE-2026-9856: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-9856: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Transformers save_pretrained path traversal allows arbitrary file writes through chat template names\n\nA vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads a\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 5.10.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-673571a194423c52", "name": "CVE-2024-12720: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2024-12720: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential applicatio\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.48.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.48.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ec519529d7c092f", "name": "CVE-2025-1194: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-1194: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and pote\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ebef67d379eeb6e", "name": "CVE-2025-2099: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-2099: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and \n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5034b12b58423eb", "name": "CVE-2025-3263: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3263: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\\.(.*)\\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catas\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9aa134a4368af37f", "name": "CVE-2025-3264: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3264: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\\s*try\\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to c\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c94ddf4332c2015", "name": "CVE-2025-3933: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3933: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption,\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.52.1\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac4ee37b7541161c", "name": "CVE-2025-5197: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-5197: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Transformers ReDoS Vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in vers\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-697a4b8c802b95b1", "name": "CVE-2025-6051: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-6051: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impac\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29d13eaf10ea6ec5", "name": "CVE-2025-6638: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-6638: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-775dc0fdb09116f6", "name": "CVE-2025-6921: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-6921: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nThe huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This is\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa7fb2c50de4bb68", "name": "CVE-2026-1839: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-1839: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12f9ebeb85d41bf1", "name": "CVE-2025-3777: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-3777: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "transformers: Improper Input Validation in huggingface/transformers\n\nHugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1\n\nPackage: transformers\nInstalled: 4.44.2\nFixed in: 4.52.1\nSeverity: LOW\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63ee0d2734a70441", "name": "CVE-2025-66418: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-66418: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion\n\nurllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.\n\nPackage: urllib3\nInstalled: 2.2.2\nFixed in: 2.6.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cb26aa2ecd857fd9", "name": "CVE-2025-66471: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-66471: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3 Streaming API improperly handles highly compressed data\n\nurllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b\n\nPackage: urllib3\nInstalled: 2.2.2\nFixed in: 2.6.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f627cb46371ed85", "name": "CVE-2026-21441: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-21441: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)\n\nurllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve\n\nPackage: urllib3\nInstalled: 2.2.2\nFixed in: 2.6.3\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.6.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c732f4f1dee6773c", "name": "CVE-2026-44431: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2026-44431: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers\n\nurllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.\n\nPackage: urllib3\nInstalled: 2.2.2\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bcd7b9762720593d", "name": "CVE-2025-50181: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-50181: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation\n\nurllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.\n\nPackage: urllib3\nInstalled: 2.2.2\nFixed in: 2.5.0\nSeverity: MEDIUM\nFix: Upgrade urllib3 to 2.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-666ab2aa759d3a5a", "name": "CVE-2025-50182: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt", "shortDescription": {"text": "CVE-2025-50182: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3 does not control redirects in browsers and Node.js\n\nurllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi\n\nPackage: urllib3\nInstalled: 2.2.2\nFixed in: 2.5.0\nSeverity: MEDIUM\nFix: Upgrade urllib3 to 2.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a544610e829f936", "name": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads\n\ncbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still ra\n\nPackage: cbor2\nInstalled: 5.8.0\nFixed in: 5.9.0\nSeverity: HIGH\nFix: Upgrade cbor2 to 5.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1654bdf26c3e7d5", "name": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outco\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 50.0.0\nSeverity: HIGH\nFix: Upgrade cryptography to 50.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1122e9d5931f249", "name": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building\n\npython-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 49.0.0\nSeverity: HIGH\nFix: Upgrade cryptography to 49.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dc29dd14a73294cf", "name": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Vulnerable OpenSSL included in cryptography wheels\n\npyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on \n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 48.0.1\nSeverity: HIGH\nFix: Upgrade cryptography to 48.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-20aa2d3ebb169689", "name": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 46.0.7\nSeverity: MEDIUM\nFix: Upgrade cryptography to 46.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d439de858be4d82", "name": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted con\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 49.0.0\nSeverity: MEDIUM\nFix: Upgrade cryptography to 49.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d62c8828c5ca36de", "name": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for b\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 46.0.6\nSeverity: LOW\nFix: Upgrade cryptography to 46.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8fd1a5a52cbb08a", "name": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django SQL injection\n\nAn issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.8, 5.1.14, 4.2.26\nSeverity: CRITICAL\nFix: Upgrade django to 5.2.8, 5.1.14, 4.2.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-45ce999d99a995a3", "name": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django SQL injection in FilteredRelation column aliases\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.24, 5.1.12, 5.2.6\nSeverity: HIGH\nFix: Upgrade django to 4.2.24, 5.1.12, 5.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ae2bbff7ca48ec18", "name": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB1\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.25, 5.1.13, 5.2.7\nSeverity: HIGH\nFix: Upgrade django to 4.2.25, 5.1.13, 5.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-942c618c1d5d48be", "name": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Django: Denial-of-service vulnerability in Django on Windows\n\nAn issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may al\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.8, 5.1.14, 4.2.26\nSeverity: HIGH\nFix: Upgrade django to 5.2.8, 5.1.14, 4.2.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e700d6c90a358ed", "name": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django: SQL injection in FilteredRelation column aliases\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\n`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.9, 5.1.15, 4.2.27\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.9, 5.1.15, 4.2.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b76df8114f15fec", "name": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django StripTags Denial of Service\n\nAn issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.21, 5.1.9, 5.2.1\nSeverity: MEDIUM\nFix: Upgrade django to 4.2.21, 5.1.9, 5.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-068e2e6cb1860ad7", "name": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django Path Injection Vulnerability\n\nAn issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.2, 5.1.10, 4.2.22\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.2, 5.1.10, 4.2.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf768f2ee1b25f73", "name": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.9, 5.1.15, 4.2.27\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.9, 5.1.15, 4.2.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e593734ce7c6ec0", "name": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django: Information disclosure via heap buffer over-read in GDALRaster\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-001de6d1be120c3c", "name": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django: HTTP header injection via DomainNameValidator accepting newlines\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\n\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64b2ba55fd837b04", "name": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Potential partial directory-traversal via archive.extract()\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.25, 5.1.13, 5.2.7\nSeverity: LOW\nFix: Upgrade django to 4.2.25, 5.1.13, 5.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4799c346e168b087", "name": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django: Information disclosure via improper handling of Vary header whitespace\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to than\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc984dded6cc1150", "name": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "django: Django: Information disclosure due to improper caching of Set-Cookie responses\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: LOW\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8524f7dc024aec28", "name": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-django: Django: Information disclosure via non-injective cookie salt derivation\n\nAn issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affec\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9237d8df081d482", "name": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Django: Django: Information disclosure due to improper handling of Cache-Control directives\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank A\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24ce905cee1788ed", "name": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "djangorestframework: Django REST framework: Denial of Service via oversized request bodies\n\nDjango REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.\n\nPackage: djangorestframework\nInstalled: 3.16.1\nFixed in: 3.17.2\nSeverity: MEDIUM\nFix: Upgrade djangorestframework to 3.17.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-976b575c07e0de4e", "name": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "djangorestframework: Django REST framework: Information disclosure via improper permission checks in AdminRenderer\n\nDjango REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.\n\nPackage: djangorestframework\nInstalled: 3.16.1\nFixed in: 3.17.2\nSeverity: MEDIUM\nFix: Upgrade djangorestframework to 3.17.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91f018bc6ea87add", "name": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-ecdsa: vulnerable to the Minerva attack\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-248df155b2174e0e", "name": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-ecdsa: ecdsa: Denial of Service via crafted DER input\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the ava\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: 0.19.2\nSeverity: MEDIUM\nFix: Upgrade ecdsa to 0.19.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ed2baf70bfc94fa", "name": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic\n\nGranian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.\n\nPackage: granian\nInstalled: 2.6.1\nFixed in: 2.7.4\nSeverity: HIGH\nFix: Upgrade granian to 2.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2b98cefcb59a1ea", "name": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Granian vulnerable to DoS via WSGI response header panic\n\nGranian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.\n\nPackage: granian\nInstalled: 2.6.1\nFixed in: 2.7.4\nSeverity: MEDIUM\nFix: Upgrade granian to 2.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecc628b54bf798cb", "name": "CVE-2026-45409: idna 3.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-45409: idna 3.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-idna: idna: Denial of Service via specially crafted long inputs\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.11\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31e040e00bf344f0", "name": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS\n\n## Circular JSON Schema `$ref` causes unbounded CPU DoS in `json_repair`\n\n### Summary\n\n`SchemaRepairer.resolve_schema()` in `json_repair` follows JSON Schema `$ref` pointers in an unbounded `while` loop without any cycle detection. An attacker who can supply a schema containing a self-referencing `$ref` (e.g., via the demo Flask API or any application that passes untrusted input to `loads(..., schema=...)`), can cause a worker process to spin indefinitely on CPU, resulting in a complete denial o\n\nPackage: json-repair\nInstalled: 0.55.0\nFixed in: 0.60.1\nSeverity: HIGH\nFix: Upgrade json-repair to 0.60.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e80b2c0c7999e4ac", "name": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langsmith-sdk-python: langsmith-sdk-js: LangSmith Client SDKs: Information disclosure via untrusted prompt deserialization\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langchain\nInstalled: 0.3.27\nFixed in: 0.3.30\nSeverity: HIGH\nFix: Upgrade langchain to 0.3.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f26871b4243f2e1b", "name": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- \n\nPackage: langchain\nInstalled: 0.3.27\nFixed in: 1.3.9\nSeverity: MEDIUM\nFix: Upgrade langchain to 1.3.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21dbbea630d5d7b5", "name": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langchain: path traversal in legacy load_prompt functions in langchain-core\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension chec\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.2.22\nSeverity: HIGH\nFix: Upgrade langchain-core to 1.2.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa557ee26a768096", "name": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=\"all\". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime path\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.3.3, 0.3.85\nSeverity: HIGH\nFix: Upgrade langchain-core to 1.3.3, 0.3.85"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a9589a23c9efb308", "name": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langchain: incomplete f-string validation in prompt templates\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate t\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 0.3.84, 1.2.28\nSeverity: MEDIUM\nFix: Upgrade langchain-core to 0.3.84, 1.2.28"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b10755e15351bdd", "name": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langchain: SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.2.11\nSeverity: LOW\nFix: Upgrade langchain-core to 1.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90ccd4eb36e1d171", "name": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters\n 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The resp\n\nPackage: langchain-text-splitters\nInstalled: 0.3.11\nFixed in: 1.1.2\nSeverity: MEDIUM\nFix: Upgrade langchain-text-splitters to 1.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-117458447f33e5c2", "name": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "langsmith-sdk-python: langsmith-sdk-js: LangSmith Client SDKs: Information disclosure via untrusted prompt deserialization\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.8.0\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48bce0196dbf6e27", "name": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read\n\n# Summary\n\nAn attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a pa\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.8.18\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a90c20864fd34c62", "name": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LangSmith SDK: Streaming token events bypass output redaction\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.7.31\nSeverity: MEDIUM\nFix: Upgrade langsmith to 0.7.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-790d97e2475b9adf", "name": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cach\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b44321ea2a54d601", "name": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\n\nBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-65549636a7d47d90", "name": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication Bypass via Host Header Injection\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route fro\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c82672891327aaf3", "name": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetchin\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2b5249c5dbc54285", "name": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting\n\nLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4cd1968eb075863e", "name": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-204dad75ee837f07", "name": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it \u2014 POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list \u2014 accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied com\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f5f2bbc3f83a39c2", "name": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Privilege escalation via API key generation with insufficient permission validation\n\nLiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.14\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33a88142cfd20548", "name": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Privilege escalation through user role modification\n\nLiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59979defd8023e7f", "name": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Unauthorized access due to authentication bypass\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-099c96d8e39da89c", "name": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass\n\n### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-00a9076b9c9810e6", "name": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function\n\nA weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9875d1e02e5d670f", "name": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Missing authentication in SSO Debug Flow allows remote access.\n\nA vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-338f961c7d4e0cc6", "name": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Directory traversal via crafted skill archive upload\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b3553beb01cc4df", "name": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.9\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.83.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5cbba8cc2b29f46", "name": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: Litellm: Improper authorization vulnerability\n\nA vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-262bbf9debc34df7", "name": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Session expiration leading to denial of service\n\nA security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4216c4a721cd99d8", "name": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: litellm: Session expiration vulnerability in SSO Authentication Flow\n\nA vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94bde684cbac0578", "name": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Incorrect authorization via prompt manipulation\n\nA security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb392625e00df4d6", "name": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Server-Side Request Forgery via spec_path argument manipulation\n\nA weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early abou\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10c2f48a6b531351", "name": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: BerriAI litellm: Information Disclosure via improper authorization in ui_view_users function\n\nA security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1161a63922e41e3a", "name": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Information disclosure via local file read in test connection endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: LOW\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc8ea53787bb9f8a", "name": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.82.0\nSeverity: LOW\nFix: Upgrade litellm to 1.82.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-332e67b09162a09c", "name": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read\n\nlxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.\n\nPackage: lxml\nInstalled: 6.0.2\nFixed in: 6.1.0\nSeverity: HIGH\nFix: Upgrade lxml to 6.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c94b0177a42a36b5", "name": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.27.2\nSeverity: HIGH\nFix: Upgrade mcp to 1.27.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2999d1e5c8db7620", "name": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.27.2\nSeverity: HIGH\nFix: Upgrade mcp to 1.27.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f4a6fa6ec5e27ade", "name": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.28.1\nSeverity: HIGH\nFix: Upgrade mcp to 1.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ad99d0be32f4592", "name": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error\n\n### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct da\n\nPackage: msgpack\nInstalled: 1.1.2\nFixed in: 1.2.1\nSeverity: HIGH\nFix: Upgrade msgpack to 1.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e0ab967aeca5d57", "name": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: Zip Slip Vulnerability in nltk Leading to Code Execution\n\nA critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-32c674579221f01c", "name": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pick ...\n\nNLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code wit\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7d5cb84adb99db3f", "name": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "NLTK versions before 3.10.3 contain a remote code execution vulnerabil ...\n\nNLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-24a66271cd03504d", "name": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-26bd172a43e3a735", "name": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary Code Execution via Eval Injection in Collocations Module\n\nNLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lo\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-701b448db4815b01", "name": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function\n\nA vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept u\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-555473065ff6c07c", "name": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via path traversal vulnerability\n\nA vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly critical in scenarios where user-controlled file inputs are processed, such as in machine learning APIs\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e3ff4b75c7caebbc", "name": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex\n\n### Summary\n`ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit (e.g. a label then `[+2]`) from each review line, using the module-level `FEATURES` regex. The feature-label sub-pattern is unbounded \u2014 an optional greedy run of word-plus-whitespace groups followed by another word, which must then be followed by a literal `[`. On a long bracket-less line the label can match from every search position to the end of the line, causing quadratic b\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-714624b83a1a6d77", "name": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)\n\n### Summary\n   A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can\n   influence the `fileids` argument of its public read methods (`header`, `raw`,\n   `words`, `sents`, `tagged_words`) to read files outside the corpus root. The\n   reader builds the file path with no containment check and opens it with the\n   builtin `open()`, so it bypasses NLTK's `nltk.pathsec` sandbox \u2014 including the\n   strict `ENFORCE = True` mode that `SECURITY.md` recommends for web/multi-tenant\n\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51d4d01045ed866a", "name": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)\n\n### Summary\n`FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is read with the builtin `open()`, bypassing `CorpusReader.open()` and the `nltk.pathsec` sandbox \u2014 including strict `ENFORCE=True` mode. A `../` sequence in the name escapes the corpus root, yielding an arbitrary XML file read whose parsed content is returned to the caller.\n\n\n### Details\n`frame_by_name` builds the path by joining the corpus root, the frame directory, and the calle\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5f2d911ae837e3ff", "name": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode\n\n### Summary\n`nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict `ENFORCE` mode for security-sensitive environments. The filter is bypassable by DNS rebinding: `validate_network_url()` resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e8728889e4e5540", "name": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unauthenticated remote shutdown\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b3a2807d9dcb603", "name": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file c\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa5d55ec611f0461", "name": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information Disclosure via Path Traversal in `nltk.data.load()`\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to by\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c283eb84d28d6ac5", "name": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure through path traversal\n\nNLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a950b269cd6053a0", "name": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "NLTK: NLTK: Bypass of path traversal and pickle deserialization protections due to insecure default configuration\n\nNLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47f86ab20687353c", "name": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via StreamBackedCorpusView bypass\n\nNLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-52e7b02d12d8823e", "name": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via symlink escape in CorpusReader.open()\n\nNLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6bebdeb0b227b61a", "name": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK TweetTokenizer: Denial of Service via crafted URL input\n\nThe URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.1\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d4acd89d8a3b3dac", "name": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "NLTK versions before 3.10.3 fail to use validated absolute paths when  ...\n\nNLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-548d7aa9e0835e32", "name": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in  ...\n\nNLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2ea59dc411cdb7a", "name": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration\n\nNLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an \n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ee6204224c6a639", "name": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors\n\nNLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fea23603fe45ce8e", "name": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via path traversal with symlink bypass\n\nNLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c0649f1f5d766e66", "name": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unvalidated regular expressions\n\nNLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e399efdb9a0aa76", "name": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service vulnerability in tgrep module\n\nNLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing i\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c138062bc7b73df6", "name": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Unauthorized file access via path traversal in model-artifact APIs\n\nNLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff97983f4553422e", "name": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation\n\nIn nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content be\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba5dfa9f6cbe885f", "name": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars\n\n`nltk.parse.RecursiveDescentParser` (and `SteppingRecursiveDescentParser`) enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU (and/or exhaust the Python recursion stack), pinning a process indefinitely \u2014 a denial of service.\n\n## Proof of concept\n\nBoth of the following hang on a 24-token input (killed after 8s; growth is super-linear in input length), on NLTK develop:\n\n```python\nfrom nltk import\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f38620aa51c77a89", "name": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` contains a reflected cross-site scripting issue in the `lookup_...` route. A crafted `lookup_<payload>` URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled `word` data is reflected into HTML without escaping. This impacts users running the l\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d2df0c57c78a8dc", "name": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Server-Side Request Forgery bypass via DNS resolution failures\n\nNLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebin\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57e87c4d07c3749d", "name": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read due to logic bug in FileSystemPathPointer\n\nNLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c66d64acc6030833", "name": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unbounded recursion in JSONTaggedDecoder\n\nNLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10e2d04667ea7a99", "name": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing\n\nnltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causin\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66eb3ebb32514156", "name": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via malformed XML corpus files\n\nNLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70979e81cf3fd145", "name": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via Uncontrolled Recursion\n\nNLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-895b62b6bb4c57e8", "name": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks\n\nNLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a7e0a749fc73582", "name": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "nltk: NLTK: Filesystem containment bypass allows local file overwrite\n\nNLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58d0601410b12520", "name": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "orjson: orjson: Denial of Service due to unbounded recursion with deeply nested JSON documents\n\nThe orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.\n\nPackage: orjson\nInstalled: 3.11.5\nFixed in: 3.11.6\nSeverity: HIGH\nFix: Upgrade orjson to 3.11.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e52c5722e628e74", "name": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image\n\nPillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.1.1\nSeverity: HIGH\nFix: Upgrade pillow to 12.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32fab04dde93f6d7", "name": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dc519e99770cf07d", "name": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing\n\nPillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e837ce83bd8f955f", "name": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image\n\nPillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b52ba916f9d67d2", "name": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2bb4c003148caecf", "name": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7693dea7dc801052", "name": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92a35f9a6f76525b", "name": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-480b4cd0d60eb2d4", "name": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Native heap out-of-bounds write\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4ed2faeb3e1cb74", "name": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-537004c4db1d4a42", "name": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of service via crafted PDF stream\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-61c2535dae39d209", "name": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b53792b820cc7621", "name": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-151dd397cd023e96", "name": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing\n\nPillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-684e688fd4ba19bd", "name": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via specially crafted coordinate input\n\nPillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77887b127c9f4680", "name": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via malicious PDF processing\n\nPillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d55440bb2e2ef9ca", "name": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths\n\nPillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-879f245bd848e06b", "name": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read\n\nPillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f51b289204e1947", "name": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted EPS file\n\nPillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb5eec094feca9e5", "name": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.2\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6688f61ebeed2245", "name": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with \"Indefinite Length\" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consu\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.3\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43ebcf2331d5ef08", "name": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pyasn1: pyasn1: Denial of Service via crafted BER input\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is f\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90fbc11cceb4c7d7", "name": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values.\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e47712236c41437", "name": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-504a7fcbaca77db9", "name": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size\n\n### Summary\n\n`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing **outside** `secrets_dir` is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented `secrets_dir_max_size` protection. An attacker or lower-privileged component able to influence entries in the configured secrets dire\n\nPackage: pydantic-settings\nInstalled: 2.12.0\nFixed in: 2.14.2\nSeverity: MEDIUM\nFix: Upgrade pydantic-settings to 2.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-464591ef0a8dc149", "name": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.12.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5f87b1e6d26e0d02", "name": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9fea73d949915f76", "name": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parame\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92f436c7a6595637", "name": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access\n\nPyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, adv\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f745deb4a5e3131", "name": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens\n\nPyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89eecfc99051a0d3", "name": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint be\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2ecbd7b61ef4347", "name": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.2\nSeverity: HIGH\nFix: Upgrade pypdf to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-958af2e6bd361b65", "name": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF inline image\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.1\nSeverity: HIGH\nFix: Upgrade pypdf to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c99a5aa32fd2fec2", "name": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf Infinite Loop when processing outlines/bookmarks\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.6.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb34b674c4ef0c94", "name": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with TreeObject outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3caa1b0374b616f8", "name": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large font values\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05b1311f66ecd478", "name": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-396b3bba80f674e5", "name": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e45c77ca581a0e4", "name": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.4\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae8cadb67e0f674c", "name": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.5\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c251924ccfb7055", "name": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.8.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c62c4b2dfce5faee", "name": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.9.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-605387da7dc2b8c2", "name": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.9.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fea2300a71496a30", "name": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata\n\npypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-984d992f3a6a60d8", "name": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with oversized streams\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41df8a4b6b52f485", "name": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68eeb0583870c5fb", "name": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-190aeace19cedc03", "name": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large image sizes\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6f31611c9a57e7d", "name": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large character offsets\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54820e4f7db2c810", "name": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-252de2ed4c1da062", "name": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9528fb066d64ba8", "name": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8475394eed76070d", "name": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64306316d0efdaf5", "name": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-578fe2be8f3dd6b0", "name": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f844a1986bb0047", "name": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f27e959d2fa0b5ac", "name": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9919873076418da1", "name": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Possible large memory usage for wrong image dimensions\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f044f254f642169b", "name": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large CID font width ranges\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16442659192af62c", "name": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large /ToUnicode streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b4a21a2a817f16b", "name": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via inefficient handling of non-whitespace inputs\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8045f51c8ba0d4a0", "name": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with cyclic tree structure\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95c08d25f365f241", "name": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12691c54e183f870", "name": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF XForm objects\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c24dbf2af1b3be46", "name": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: Missing stream length values ignore defined limits\n\n### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value.\n\n### Patches\nThis has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3).\n\n### Workarounds\nIf you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70e11d0f02500fe4", "name": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.2\nSeverity: LOW\nFix: Upgrade pypdf to 6.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-251f754d66f2c1ec", "name": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following\n\npython-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.\n\nPackage: python-dotenv\nInstalled: 1.2.1\nFixed in: 1.2.2\nSeverity: MEDIUM\nFix: Upgrade python-dotenv to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c26f9387f688fedd", "name": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "requests: Requests: Security bypass due to predictable temporary file creation\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner\n\nPackage: requests\nInstalled: 2.32.5\nFixed in: 2.33.0\nSeverity: MEDIUM\nFix: Upgrade requests to 2.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3cc393f47c3ab88c", "name": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)\n\nsetuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.\n\nPackage: setuptools\nInstalled: 80.9.0\nFixed in: 83.0.0\nSeverity: MEDIUM\nFix: Upgrade setuptools to 83.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db2a3d237243648f", "name": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67ea6c97d8a22004", "name": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fi\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1955bd7ffad93702", "name": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quad\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.9.0\nSeverity: MEDIUM\nFix: Upgrade soupsieve to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-923d9ac424068f44", "name": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits b\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.9.0\nSeverity: MEDIUM\nFix: Upgrade soupsieve to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59bcc30541ceb06e", "name": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee69750139f5f7dc", "name": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via inefficient SQL parsing\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f77ae8755dd917fb", "name": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13a5f0128e2fb7c3", "name": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "sqlparse: sqlparse: Arbitrary code execution via unescaped backslashes in generated snippets\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: MEDIUM\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64b509f826dc8dae", "name": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0. ...\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing r\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: MEDIUM\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ec1d29439923900", "name": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.1.0\nSeverity: HIGH\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da9b653b6e26e627", "name": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\n\nStarlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.3.1\nSeverity: HIGH\nFix: Upgrade starlette to 1.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c199bd44e3522f40", "name": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) \n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7d1c9fbe4a89849", "name": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.1.0\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-699be9582b3bbe40", "name": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure due to improper HTTP request path validation\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header \n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade starlette to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ce8f7ef73944bf0", "name": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "tornado-python: Tornado: Denial of Service via large multipart bodies\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b1b0ae5aa24cc97", "name": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments\n\nIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6ef6fca9515db3f", "name": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9870fb6f0d79c968", "name": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b1e94ff29d2447da", "name": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Tornado is a Python web framework and asynchronous networking library. ...\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronous\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.8\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3fc23b9107f1b26", "name": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Tornado has incomplete validation of cookie attributes\n\nValues passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95bf7d7a69ea2350", "name": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)\n\n## Description\n\n### Summary\n\n`parse_multipart_form_data` (httputil.py:34) calls\n`data.split(b\"--\"+boundary+b\"\\r\\n\")` **before** the `max_parts` check (:35).\nA 600KB body with 100k parts creates a 100k-element transient list first,\nthen rejects   transient memory amplification (each split element is a copy).\nPre-auth HTTP DoS.\n\n### Root cause\n\n```python\nparts = data[:final_boundary_index].split(b\"--\" + boundary + b\"\\r\\n\")  # :34  huge list first\nif len(parts) > config.max_parts:                  \n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.8\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f28a95807fe151f1", "name": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n# CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n## Summary\n\n`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does\nnot reset them between requests, and several per-request options are applied with\nno clearing branch. As a result, sensitive state set by one request persists onto\na later request on the same client that does not set it. Two credential vectors\nare demonstrated below \u2014 a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy\nbasic-auth cr\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.7\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c0ce244d87625bf", "name": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/requirements.txt", "shortDescription": {"text": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "fullDescription": {"text": "tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: LOW\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c53b258d49e5dd2", "name": "CVE-2026-27962: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-27962: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.9\nSeverity: CRITICAL\nFix: Upgrade authlib to 1.6.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6be4a52a9c504c24", "name": "CVE-2026-28490: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-28490: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "authlib: Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements cor\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.9\nSeverity: HIGH\nFix: Upgrade authlib to 1.6.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab341f05017d9525", "name": "CVE-2026-28498: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-28498: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorit\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.9\nSeverity: HIGH\nFix: Upgrade authlib to 1.6.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-994ca034952f8da1", "name": "CVE-2026-28802: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-28802: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.7\nSeverity: HIGH\nFix: Upgrade authlib to 1.6.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98196d338c8ae110", "name": "CVE-2026-41425: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41425: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "authlib: Authlib: Cross-Site Request Forgery (CSRF) vulnerability in OAuth cache feature\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth.  This vulnerability is fixed in 1.6.11.\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.11\nSeverity: MEDIUM\nFix: Upgrade authlib to 1.6.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae9388ee9d1a21e6", "name": "CVE-2026-41479: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41479: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "authlib: Authlib: Open Redirect vulnerability via crafted authorization requests\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. \n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.6.10, 1.7.1\nSeverity: MEDIUM\nFix: Upgrade authlib to 1.6.10, 1.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1aeba9ae06c02437", "name": "CVE-2026-44681: authlib 1.6.6 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-44681: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Authlib is a Python library which builds OAuth and OpenID Connect serv ...\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.\n\nPackage: authlib\nInstalled: 1.6.6\nFixed in: 1.7.1, 1.6.12\nSeverity: MEDIUM\nFix: Upgrade authlib to 1.7.1, 1.6.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6668af700ce13d83", "name": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads\n\ncbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still ra\n\nPackage: cbor2\nInstalled: 5.8.0\nFixed in: 5.9.0\nSeverity: HIGH\nFix: Upgrade cbor2 to 5.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d5c4374b9f87de3", "name": "CVE-2026-45829: chromadb 1.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45829: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection\n\nA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the\u00a0/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: CRITICAL\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d003c450437d52dd", "name": "CVE-2026-45833: chromadb 1.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45833: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "chromadb: ChromaDB: Arbitrary Code Execution via Code Injection\n\nA code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the\u00a0/api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: CRITICAL\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8a4ebebfb1e46721", "name": "CVE-2026-45830: chromadb 1.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45830: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "chromadb: ChromaDB: Unauthorized data manipulation due to improper authorization validation\n\nA lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f2ff9b5e4ec8721", "name": "CVE-2026-45831: chromadb 1.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45831: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "ChromaDB: ChromaDB: Unauthorized cross-tenant actions due to improper authorization checks\n\nThe SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.\n\nPackage: chromadb\nInstalled: 1.5.5\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afdfafeb4c9c9e6d", "name": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outco\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 50.0.0\nSeverity: HIGH\nFix: Upgrade cryptography to 50.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d8e9034f987c2a7", "name": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building\n\npython-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 49.0.0\nSeverity: HIGH\nFix: Upgrade cryptography to 49.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f09551586f16d2c", "name": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Vulnerable OpenSSL included in cryptography wheels\n\npyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on \n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 48.0.1\nSeverity: HIGH\nFix: Upgrade cryptography to 48.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2dc186b9145206e2", "name": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 46.0.7\nSeverity: MEDIUM\nFix: Upgrade cryptography to 46.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5af6e4abca548f32", "name": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted con\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 49.0.0\nSeverity: MEDIUM\nFix: Upgrade cryptography to 49.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e5579ada0a9e94e", "name": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for b\n\nPackage: cryptography\nInstalled: 46.0.5\nFixed in: 46.0.6\nSeverity: LOW\nFix: Upgrade cryptography to 46.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ff9b39bb05969d2", "name": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django SQL injection\n\nAn issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.8, 5.1.14, 4.2.26\nSeverity: CRITICAL\nFix: Upgrade django to 5.2.8, 5.1.14, 4.2.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-03333e35017fe82b", "name": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django SQL injection in FilteredRelation column aliases\n\nAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.24, 5.1.12, 5.2.6\nSeverity: HIGH\nFix: Upgrade django to 4.2.24, 5.1.12, 5.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e30a74a7b3eb5b82", "name": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB1\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.25, 5.1.13, 5.2.7\nSeverity: HIGH\nFix: Upgrade django to 4.2.25, 5.1.13, 5.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7002463a20ecc8aa", "name": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Django: Denial-of-service vulnerability in Django on Windows\n\nAn issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may al\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.8, 5.1.14, 4.2.26\nSeverity: HIGH\nFix: Upgrade django to 5.2.8, 5.1.14, 4.2.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4a7a3fde2b93cc34", "name": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django: SQL injection in FilteredRelation column aliases\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\n`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.9, 5.1.15, 4.2.27\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.9, 5.1.15, 4.2.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6381bdb8577f8bd5", "name": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django StripTags Denial of Service\n\nAn issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.21, 5.1.9, 5.2.1\nSeverity: MEDIUM\nFix: Upgrade django to 4.2.21, 5.1.9, 5.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fa82eb8a57fc4b1", "name": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django Path Injection Vulnerability\n\nAn issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.2, 5.1.10, 4.2.22\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.2, 5.1.10, 4.2.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed26e781227554c5", "name": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.9, 5.1.15, 4.2.27\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.9, 5.1.15, 4.2.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b66f8edad3772f59", "name": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django: Information disclosure via heap buffer over-read in GDALRaster\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-819fa5668879a7c8", "name": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django: HTTP header injection via DomainNameValidator accepting newlines\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\n\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: MEDIUM\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3796f996759df316", "name": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Potential partial directory-traversal via archive.extract()\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 4.2.25, 5.1.13, 5.2.7\nSeverity: LOW\nFix: Upgrade django to 4.2.25, 5.1.13, 5.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5cad7e48763e6a7", "name": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django: Information disclosure via improper handling of Vary header whitespace\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to than\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c44ab91ad40efc01", "name": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "django: Django: Information disclosure due to improper caching of Set-Cookie responses\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue.\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.16, 6.0.7\nSeverity: LOW\nFix: Upgrade django to 5.2.16, 6.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee3d2985a3d083d3", "name": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-django: Django: Information disclosure via non-injective cookie salt derivation\n\nAn issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affec\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0979ef0d974d971", "name": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Django: Django: Information disclosure due to improper handling of Cache-Control directives\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank A\n\nPackage: django\nInstalled: 5.1.8\nFixed in: 5.2.15, 6.0.6\nSeverity: LOW\nFix: Upgrade django to 5.2.15, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-604f297fd3bb0488", "name": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "djangorestframework: Django REST framework: Denial of Service via oversized request bodies\n\nDjango REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.\n\nPackage: djangorestframework\nInstalled: 3.16.1\nFixed in: 3.17.2\nSeverity: MEDIUM\nFix: Upgrade djangorestframework to 3.17.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74514e6b2e5d87a7", "name": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "djangorestframework: Django REST framework: Information disclosure via improper permission checks in AdminRenderer\n\nDjango REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.\n\nPackage: djangorestframework\nInstalled: 3.16.1\nFixed in: 3.17.2\nSeverity: MEDIUM\nFix: Upgrade djangorestframework to 3.17.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24dd58884d75965f", "name": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-ecdsa: vulnerable to the Minerva attack\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f8debfa35bcc1b3", "name": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-ecdsa: ecdsa: Denial of Service via crafted DER input\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the ava\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: 0.19.2\nSeverity: MEDIUM\nFix: Upgrade ecdsa to 0.19.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27ae8df3e6401230", "name": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic\n\nGranian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.\n\nPackage: granian\nInstalled: 2.6.1\nFixed in: 2.7.4\nSeverity: HIGH\nFix: Upgrade granian to 2.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7412d416149ac05b", "name": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Granian vulnerable to DoS via WSGI response header panic\n\nGranian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.\n\nPackage: granian\nInstalled: 2.6.1\nFixed in: 2.7.4\nSeverity: MEDIUM\nFix: Upgrade granian to 2.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f84b8da172ccd8eb", "name": "CVE-2026-71554: h2 4.3.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-71554: h2 4.3.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "h2: h2: Request smuggling due to duplicate Host headers\n\nh2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.\n\nPackage: h2\nInstalled: 4.3.0\nFixed in: 4.4.1\nSeverity: MEDIUM\nFix: Upgrade h2 to 4.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee992fac32822ca5", "name": "CVE-2026-45409: idna 3.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45409: idna 3.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-idna: idna: Denial of Service via specially crafted long inputs\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.11\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-720dbd3cb1fe0832", "name": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS\n\n## Circular JSON Schema `$ref` causes unbounded CPU DoS in `json_repair`\n\n### Summary\n\n`SchemaRepairer.resolve_schema()` in `json_repair` follows JSON Schema `$ref` pointers in an unbounded `while` loop without any cycle detection. An attacker who can supply a schema containing a self-referencing `$ref` (e.g., via the demo Flask API or any application that passes untrusted input to `loads(..., schema=...)`), can cause a worker process to spin indefinitely on CPU, resulting in a complete denial o\n\nPackage: json-repair\nInstalled: 0.55.0\nFixed in: 0.60.1\nSeverity: HIGH\nFix: Upgrade json-repair to 0.60.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-724ba484cc310a76", "name": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langsmith-sdk-python: langsmith-sdk-js: LangSmith Client SDKs: Information disclosure via untrusted prompt deserialization\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langchain\nInstalled: 0.3.27\nFixed in: 0.3.30\nSeverity: HIGH\nFix: Upgrade langchain to 0.3.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc6e8fc579b78174", "name": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- \n\nPackage: langchain\nInstalled: 0.3.27\nFixed in: 1.3.9\nSeverity: MEDIUM\nFix: Upgrade langchain to 1.3.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3ac1b9310f074f6", "name": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langchain: path traversal in legacy load_prompt functions in langchain-core\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension chec\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.2.22\nSeverity: HIGH\nFix: Upgrade langchain-core to 1.2.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1ea9d36cecd24f5", "name": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=\"all\". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime path\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.3.3, 0.3.85\nSeverity: HIGH\nFix: Upgrade langchain-core to 1.3.3, 0.3.85"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c5a0cd6f29bb0a9", "name": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langchain: incomplete f-string validation in prompt templates\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate t\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 0.3.84, 1.2.28\nSeverity: MEDIUM\nFix: Upgrade langchain-core to 0.3.84, 1.2.28"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-317a8e6a6d0cccce", "name": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langchain: SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.\n\nPackage: langchain-core\nInstalled: 0.3.83\nFixed in: 1.2.11\nSeverity: LOW\nFix: Upgrade langchain-core to 1.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d87733f1caa227cd", "name": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters\n 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The resp\n\nPackage: langchain-text-splitters\nInstalled: 0.3.11\nFixed in: 1.1.2\nSeverity: MEDIUM\nFix: Upgrade langchain-text-splitters to 1.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-949d09aac21934a9", "name": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "langsmith-sdk-python: langsmith-sdk-js: LangSmith Client SDKs: Information disclosure via untrusted prompt deserialization\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.8.0\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c9adfbdffa1c8417", "name": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read\n\n# Summary\n\nAn attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a pa\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.8.18\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c60a5b1967c9768", "name": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LangSmith SDK: Streaming token events bypass output redaction\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (\n\nPackage: langsmith\nInstalled: 0.6.3\nFixed in: 0.7.31\nSeverity: MEDIUM\nFix: Upgrade langsmith to 0.7.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25e32907f7969e75", "name": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cach\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-135478de55e96561", "name": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint\n\nBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d21b7120be94d886", "name": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication Bypass via Host Header Injection\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route fro\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e315a1b70b591a8a", "name": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetchin\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4236d588d322755", "name": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting\n\nLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f6c213bc1b624945", "name": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4308ae5358aa9069", "name": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it \u2014 POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list \u2014 accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied com\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f312645d5756268", "name": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Privilege escalation via API key generation with insufficient permission validation\n\nLiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.14\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab4b6e03156b5db9", "name": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Privilege escalation through user role modification\n\nLiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-271975e13c4e7689", "name": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Unauthorized access due to authentication bypass\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-abb262dcfc282aa6", "name": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass\n\n### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-845584e2b2856dea", "name": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function\n\nA weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.84.0\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a5eb9e64f973bb5", "name": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: BerriAI litellm: Missing authentication in SSO Debug Flow allows remote access.\n\nA vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efd63a02d07c312d", "name": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Directory traversal via crafted skill archive upload\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.7\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a009c3e262533581", "name": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected \n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.9\nSeverity: MEDIUM\nFix: Upgrade litellm to 1.83.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2816e5eb8d38ca1", "name": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: Litellm: Improper authorization vulnerability\n\nA vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a28e0a9a77c3b2b0", "name": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: BerriAI litellm: Session expiration leading to denial of service\n\nA security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62146f9094acb59c", "name": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: litellm: Session expiration vulnerability in SSO Authentication Flow\n\nA vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79b58f3c651c496d", "name": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: BerriAI litellm: Incorrect authorization via prompt manipulation\n\nA security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b578046a19cf995e", "name": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: BerriAI litellm: Server-Side Request Forgery via spec_path argument manipulation\n\nA weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early abou\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41d37f8401547b0f", "name": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: BerriAI litellm: Information Disclosure via improper authorization in ui_view_users function\n\nA security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b69e2ec83e4d1ee7", "name": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Information disclosure via local file read in test connection endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.83.10\nSeverity: LOW\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb422cf0f3739790", "name": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.\n\nPackage: litellm\nInstalled: 1.81.11\nFixed in: 1.82.0\nSeverity: LOW\nFix: Upgrade litellm to 1.82.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-954b773119deb8b7", "name": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read\n\nlxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.\n\nPackage: lxml\nInstalled: 6.0.2\nFixed in: 6.1.0\nSeverity: HIGH\nFix: Upgrade lxml to 6.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-86a78b246c136bda", "name": "CVE-2026-41205: mako 1.3.10 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41205: mako 1.3.10 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "mako: Mako: Information disclosure via path traversal vulnerability\n\nMako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.\n\nPackage: mako\nInstalled: 1.3.10\nFixed in: 1.3.11\nSeverity: HIGH\nFix: Upgrade mako to 1.3.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83aa96b6e7e5d96a", "name": "CVE-2026-44307: mako 1.3.10 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-44307: mako 1.3.10 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "mako: Mako: Information disclosure via directory traversal\n\nMako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.\n\nPackage: mako\nInstalled: 1.3.10\nFixed in: 1.3.12\nSeverity: HIGH\nFix: Upgrade mako to 1.3.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-653aa43f9d6726f8", "name": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.27.2\nSeverity: HIGH\nFix: Upgrade mcp to 1.27.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca20c5e651d2518c", "name": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.27.2\nSeverity: HIGH\nFix: Upgrade mcp to 1.27.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f75ace49dc88576", "name": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.\n\nPackage: mcp\nInstalled: 1.26.0\nFixed in: 1.28.1\nSeverity: HIGH\nFix: Upgrade mcp to 1.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b42e47d9e7b71e24", "name": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error\n\n### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct da\n\nPackage: msgpack\nInstalled: 1.1.2\nFixed in: 1.2.1\nSeverity: HIGH\nFix: Upgrade msgpack to 1.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43e883c79eac95b1", "name": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: Zip Slip Vulnerability in nltk Leading to Code Execution\n\nA critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-448405a2e9aea74e", "name": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pick ...\n\nNLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code wit\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-264eaa1e141a1d03", "name": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "NLTK versions before 3.10.3 contain a remote code execution vulnerabil ...\n\nNLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8e96d1f768a61559", "name": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: CRITICAL\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e2acbc37461845f6", "name": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary Code Execution via Eval Injection in Collocations Module\n\nNLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lo\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f2cd55deaf09722c", "name": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function\n\nA vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept u\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-54474ce9be81a411", "name": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via path traversal vulnerability\n\nA vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly critical in scenarios where user-controlled file inputs are processed, such as in machine learning APIs\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e5eaae7860e066c8", "name": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex\n\n### Summary\n`ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit (e.g. a label then `[+2]`) from each review line, using the module-level `FEATURES` regex. The feature-label sub-pattern is unbounded \u2014 an optional greedy run of word-plus-whitespace groups followed by another word, which must then be followed by a literal `[`. On a long bracket-less line the label can match from every search position to the end of the line, causing quadratic b\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3110726031830a0b", "name": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)\n\n### Summary\n   A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can\n   influence the `fileids` argument of its public read methods (`header`, `raw`,\n   `words`, `sents`, `tagged_words`) to read files outside the corpus root. The\n   reader builds the file path with no containment check and opens it with the\n   builtin `open()`, so it bypasses NLTK's `nltk.pathsec` sandbox \u2014 including the\n   strict `ENFORCE = True` mode that `SECURITY.md` recommends for web/multi-tenant\n\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d2ddcdd7fcad149", "name": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)\n\n### Summary\n`FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is read with the builtin `open()`, bypassing `CorpusReader.open()` and the `nltk.pathsec` sandbox \u2014 including strict `ENFORCE=True` mode. A `../` sequence in the name escapes the corpus root, yielding an arbitrary XML file read whose parsed content is returned to the caller.\n\n\n### Details\n`frame_by_name` builds the path by joining the corpus root, the frame directory, and the calle\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66f8df3bea13f55f", "name": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode\n\n### Summary\n`nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict `ENFORCE` mode for security-sensitive environments. The filter is bypassable by DNS rebinding: `validate_network_url()` resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f8f4732bb7520035", "name": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unauthenticated remote shutdown\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90d363c7e9042b38", "name": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file c\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2ff6b00d2cfb911b", "name": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Information Disclosure via Path Traversal in `nltk.data.load()`\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to by\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-216439116a80251e", "name": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure through path traversal\n\nNLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f494e450e898e727", "name": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "NLTK: NLTK: Bypass of path traversal and pickle deserialization protections due to insecure default configuration\n\nNLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-828d95ac23be2b62", "name": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read via StreamBackedCorpusView bypass\n\nNLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b8e30bff0a9e7ea9", "name": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via symlink escape in CorpusReader.open()\n\nNLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: HIGH\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2ead8c183f7141a1", "name": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK TweetTokenizer: Denial of Service via crafted URL input\n\nThe URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.1\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1a90d9cd193d013", "name": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "NLTK versions before 3.10.3 fail to use validated absolute paths when  ...\n\nNLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-079c41d2a2d49cd5", "name": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in  ...\n\nNLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98e87bc35ac5cd13", "name": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration\n\nNLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an \n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a164e4a77cf3731e", "name": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors\n\nNLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13d072adc6ef54e8", "name": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Information disclosure via path traversal with symlink bypass\n\nNLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe92f6f378c7cc14", "name": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unvalidated regular expressions\n\nNLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4016729a1b341700", "name": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service vulnerability in tgrep module\n\nNLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing i\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb9fad4ff0da97ad", "name": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Unauthorized file access via path traversal in model-artifact APIs\n\nNLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d65bed1d5164fd4e", "name": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation\n\nIn nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content be\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-047a77b765e14e0a", "name": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars\n\n`nltk.parse.RecursiveDescentParser` (and `SteppingRecursiveDescentParser`) enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU (and/or exhaust the Python recursion stack), pinning a process indefinitely \u2014 a denial of service.\n\n## Proof of concept\n\nBoth of the following hang on a 24-token input (killed after 8s; growth is super-linear in input length), on NLTK develop:\n\n```python\nfrom nltk import\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e42c1c064216bc80", "name": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` contains a reflected cross-site scripting issue in the `lookup_...` route. A crafted `lookup_<payload>` URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled `word` data is reflected into HTML without escaping. This impacts users running the l\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0727f55ad1964c45", "name": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Server-Side Request Forgery bypass via DNS resolution failures\n\nNLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebin\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ce6e29e61682d32", "name": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Arbitrary file read due to logic bug in FileSystemPathPointer\n\nNLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.0\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13e0193898b87ae7", "name": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via unbounded recursion in JSONTaggedDecoder\n\nNLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.9.4\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.9.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e754d175a0dcc32", "name": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing\n\nnltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causin\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-518bccbd332cd728", "name": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via malformed XML corpus files\n\nNLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3cbb756b1b199b7", "name": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Denial of Service via Uncontrolled Recursion\n\nNLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7193afba45a3d204", "name": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks\n\nNLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3720b43a8da078ba", "name": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Filesystem containment bypass allows local file overwrite\n\nNLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.\n\nPackage: nltk\nInstalled: 3.9.2\nFixed in: 3.10.3\nSeverity: MEDIUM\nFix: Upgrade nltk to 3.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71fa1ff4e19f97eb", "name": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "orjson: orjson: Denial of Service due to unbounded recursion with deeply nested JSON documents\n\nThe orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.\n\nPackage: orjson\nInstalled: 3.11.5\nFixed in: 3.11.6\nSeverity: HIGH\nFix: Upgrade orjson to 3.11.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b1bed581e973b27", "name": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image\n\nPillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.1.1\nSeverity: HIGH\nFix: Upgrade pillow to 12.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a034b12e8434a0c0", "name": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4873f2bf3b03800e", "name": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing\n\nPillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a0182089ec7069b6", "name": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image\n\nPillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92ff301a6892f5ef", "name": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d03265e5499535d3", "name": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f221fa12e272fcc", "name": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5079ee6d2e7042bd", "name": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b43f796ea62d74d", "name": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Native heap out-of-bounds write\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-804417a51820c285", "name": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ac4ad31f656f35b", "name": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of service via crafted PDF stream\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de19ba5b9679573a", "name": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72998bb8c5587908", "name": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-58267cc749954709", "name": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing\n\nPillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-852a673176eaf328", "name": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via specially crafted coordinate input\n\nPillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73cf4a393c7645d6", "name": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via malicious PDF processing\n\nPillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f066121357c542d4", "name": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths\n\nPillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-403dce1ed88524bb", "name": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read\n\nPillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba15c727dbc8e361", "name": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted EPS file\n\nPillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.1.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63deee79fd3444ad", "name": "CVE-2026-25087: pyarrow 22.0.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-25087: pyarrow 22.0.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files\n\nUse After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shar\n\nPackage: pyarrow\nInstalled: 22.0.0\nFixed in: 23.0.1\nSeverity: HIGH\nFix: Upgrade pyarrow to 23.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9840bc76cec33681", "name": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.2\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b44fde6eb531940", "name": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with \"Indefinite Length\" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consu\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.3\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7fa67243b1c583cb", "name": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pyasn1: pyasn1: Denial of Service via crafted BER input\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is f\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-58f293a615917d9b", "name": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values.\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf7cc9b2811b837d", "name": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print\n\nPackage: pyasn1\nInstalled: 0.6.1\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-340c92277b331eb0", "name": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size\n\n### Summary\n\n`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing **outside** `secrets_dir` is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented `secrets_dir_max_size` protection. An attacker or lower-privileged component able to influence entries in the configured secrets dire\n\nPackage: pydantic-settings\nInstalled: 2.12.0\nFixed in: 2.14.2\nSeverity: MEDIUM\nFix: Upgrade pydantic-settings to 2.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86b6da008d33a359", "name": "CVE-2026-4539: pygments 2.19.2 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer\n\nA security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nPackage: pygments\nInstalled: 2.19.2\nFixed in: 2.20.0\nSeverity: LOW\nFix: Upgrade pygments to 2.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adbe8c02909d4eac", "name": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.12.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1560d4b53a5a04a0", "name": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab221fc387c599a4", "name": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parame\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-933436573ec4e821", "name": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access\n\nPyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, adv\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9353ccfff8b38777", "name": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens\n\nPyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d74734504eec8460", "name": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint be\n\nPackage: pyjwt\nInstalled: 2.10.1\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13f61016a7eb6998", "name": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.2\nSeverity: HIGH\nFix: Upgrade pypdf to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caef7cd7a74af7db", "name": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF inline image\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.1\nSeverity: HIGH\nFix: Upgrade pypdf to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fdf4080156d795f0", "name": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf Infinite Loop when processing outlines/bookmarks\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.6.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f695e2c8563f968b", "name": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with TreeObject outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e4762c5d47af52d", "name": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large font values\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd17504a676e6672", "name": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28a820dad0cbb88d", "name": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a71b1fa0633acf2", "name": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.4\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-581d0fc754c541bb", "name": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.5\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.7.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e19df7e5b6a84053", "name": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.8.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e40ce875bad9a0d9", "name": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.9.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c881f4a98d306dc", "name": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.9.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46720847cab0bed8", "name": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata\n\npypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be1ae6f272f6c8f3", "name": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with oversized streams\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bbb6ca8e4a46eb6", "name": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ad86577e7ba0d1e", "name": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4ad6c7022273e5b", "name": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large image sizes\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ba6287c55820db6", "name": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large character offsets\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce15e173f3649a55", "name": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59ca66d8a1c1134d", "name": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea1a3d3b409e64f", "name": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1be49d770c4aef11", "name": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-800109fc0ca4a95d", "name": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3041709eb1402e78", "name": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e978bbc64c8ea836", "name": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91504f1935b15cb9", "name": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-247182237e96b321", "name": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Possible large memory usage for wrong image dimensions\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.14.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f60be5a998e63426", "name": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large CID font width ranges\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-589f1eb0731e08a4", "name": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large /ToUnicode streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-310261800682b65a", "name": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via inefficient handling of non-whitespace inputs\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.15.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11df9d8dfdd50ae5", "name": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with cyclic tree structure\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e7da752316ac450", "name": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c973ddf26bf468dc", "name": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF XForm objects\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.16.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ad2df3f8aecaa5b", "name": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: Missing stream length values ignore defined limits\n\n### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value.\n\n### Patches\nThis has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3).\n\n### Workarounds\nIf you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.13.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4961063d03e37444", "name": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.\n\nPackage: pypdf\nInstalled: 6.6.0\nFixed in: 6.7.2\nSeverity: LOW\nFix: Upgrade pypdf to 6.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d4a477c2f5f55aa", "name": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following\n\npython-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.\n\nPackage: python-dotenv\nInstalled: 1.2.1\nFixed in: 1.2.2\nSeverity: MEDIUM\nFix: Upgrade python-dotenv to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f79d93b16415f16", "name": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "requests: Requests: Security bypass due to predictable temporary file creation\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner\n\nPackage: requests\nInstalled: 2.32.5\nFixed in: 2.33.0\nSeverity: MEDIUM\nFix: Upgrade requests to 2.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-281fbd4664dc89fc", "name": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)\n\nsetuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.\n\nPackage: setuptools\nInstalled: 80.9.0\nFixed in: 83.0.0\nSeverity: MEDIUM\nFix: Upgrade setuptools to 83.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbdb9bafd28b627b", "name": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0242309e0098fdc8", "name": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fi\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8799013679a249fe", "name": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quad\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.9.0\nSeverity: MEDIUM\nFix: Upgrade soupsieve to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-685d46a9efca5381", "name": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits b\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.9.0\nSeverity: MEDIUM\nFix: Upgrade soupsieve to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e54f9aa53e57255d", "name": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-737c27cfaacdb6ec", "name": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via inefficient SQL parsing\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-722ac2385d5138fe", "name": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: HIGH\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e5519a1ac62bb71b", "name": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "sqlparse: sqlparse: Arbitrary code execution via unescaped backslashes in generated snippets\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: MEDIUM\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e30f10eb8a77abb4", "name": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "sqlparse is a non-validating SQL parser module for Python. Prior to 0. ...\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing r\n\nPackage: sqlparse\nInstalled: 0.5.5\nFixed in: 0.6.0\nSeverity: MEDIUM\nFix: Upgrade sqlparse to 0.6.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8562e2f03cb15f5", "name": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.1.0\nSeverity: HIGH\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-762c37a1ff8fbeb5", "name": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\n\nStarlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.3.1\nSeverity: HIGH\nFix: Upgrade starlette to 1.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdff5f1c1b1ab01d", "name": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) \n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-150c506b39d33237", "name": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo\n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.1.0\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91499012b8cbe7f8", "name": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure due to improper HTTP request path validation\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header \n\nPackage: starlette\nInstalled: 1.0.0\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade starlette to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d61dc06488b077d", "name": "CVE-2025-3000: torch 2.11.0 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2025-3000: torch 2.11.0 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "A vulnerability classified as critical has been found in PyTorch 2.6.0 ...\n\nA vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.11.0\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade torch to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e4f9fba94e0da32", "name": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "tornado-python: Tornado: Denial of Service via large multipart bodies\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-668a26e18dd58999", "name": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments\n\nIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a630b2f7fcafa3cf", "name": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de4b4ae853b06b1c", "name": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c904006295a97efe", "name": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Tornado is a Python web framework and asynchronous networking library. ...\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronous\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.8\nSeverity: HIGH\nFix: Upgrade tornado to 6.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78f509dbbf5fcc55", "name": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Tornado has incomplete validation of cookie attributes\n\nValues passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.5\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-810b38fbec817c7d", "name": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)\n\n## Description\n\n### Summary\n\n`parse_multipart_form_data` (httputil.py:34) calls\n`data.split(b\"--\"+boundary+b\"\\r\\n\")` **before** the `max_parts` check (:35).\nA 600KB body with 100k parts creates a 100k-element transient list first,\nthen rejects   transient memory amplification (each split element is a copy).\nPre-auth HTTP DoS.\n\n### Root cause\n\n```python\nparts = data[:final_boundary_index].split(b\"--\" + boundary + b\"\\r\\n\")  # :34  huge list first\nif len(parts) > config.max_parts:                  \n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.8\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ba61d9badeffcee", "name": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n# CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n## Summary\n\n`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does\nnot reset them between requests, and several per-request options are applied with\nno clearing branch. As a result, sensitive state set by one request persists onto\na later request on the same client that does not set it. Two credential vectors\nare demonstrated below \u2014 a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy\nbasic-auth cr\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.7\nSeverity: MEDIUM\nFix: Upgrade tornado to 6.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7987986fe316b676", "name": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.\n\nPackage: tornado\nInstalled: 6.5.4\nFixed in: 6.5.6\nSeverity: LOW\nFix: Upgrade tornado to 6.5.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cca2fbeaec13b81f", "name": "CVE-2026-4372: transformers 4.57.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-4372: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "HuggingFace transformers vulnerable to remote code execution\n\nA critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's re\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.3.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5c773c8434c8ff93", "name": "CVE-2026-5241: transformers 4.57.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-5241: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting\n\nA vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `Lig\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.5.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3fd21ad724a9027", "name": "CVE-2026-9856: transformers 4.57.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-9856: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "Transformers save_pretrained path traversal allows arbitrary file writes through chat template names\n\nA vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads a\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.10.0\nSeverity: HIGH\nFix: Upgrade transformers to 5.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a26b0625d2c91097", "name": "CVE-2026-1839: transformers 4.57.1 \u2014 futureagi/uv.lock", "shortDescription": {"text": "CVE-2026-1839: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.57.1\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49dd93e8d1a5b351", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.base", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.base"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2f4d27ad94e31319", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.base", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.base"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8bd279dca2eadcf", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.oss", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.oss"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile.oss"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-451b09a3d6dff267", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.oss", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.oss"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile.oss"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bf6dd4b70de2cab", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.simulation-runner", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.simulation-runner"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile.simulation-runner"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d1b21cfd9f9e18a", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.simulation-runner", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.simulation-runner"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile.simulation-runner"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20a6ee147e7ed98d", "name": "DS-0002: Image user should not be 'root' \u2014 agentcc-gateway/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 agentcc-gateway/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: agentcc-gateway/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d9065267d50894d", "name": "DS-0026: No HEALTHCHECK defined \u2014 agentcc-gateway/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 agentcc-gateway/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: agentcc-gateway/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d24b5fe1835e7803", "name": "DS-0002: Image user should not be 'root' \u2014 deploy/dev/property-catalog-docker/python-hotfix.Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 deploy/dev/property-catalog-docker/python-hotfix.Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: deploy/dev/property-catalog-docker/python-hotfix.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e17af17b611f944", "name": "DS-0026: No HEALTHCHECK defined \u2014 deploy/dev/property-catalog-docker/python-hotfix.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/dev/property-catalog-docker/python-hotfix.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: deploy/dev/property-catalog-docker/python-hotfix.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e6c097485314193", "name": "DS-0026: No HEALTHCHECK defined \u2014 fi-collector/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 fi-collector/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: fi-collector/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ab562e8604d825c", "name": "DS-0002: Image user should not be 'root' \u2014 frontend/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 frontend/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: frontend/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c600a2e51a504be", "name": "DS-0026: No HEALTHCHECK defined \u2014 frontend/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 frontend/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: frontend/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b88816d5987ba724", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7d0254a86dc7155", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e703e6b765b8343", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/Dockerfile.oss", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/Dockerfile.oss"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/Dockerfile.oss"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da5f953428ba9c07", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/Dockerfile.oss", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/Dockerfile.oss"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/Dockerfile.oss"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-105bc26cbd709903", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/code-executor/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/code-executor/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/code-executor/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e5a0355b392ef27", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/code-executor/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/code-executor/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/code-executor/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1791266f634f9cb6", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/code-executor/Dockerfile.base", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/code-executor/Dockerfile.base"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/code-executor/Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a53f1c48835286e", "name": "DS-0013: 'RUN cd ...' to change directory \u2014 futureagi/code-executor/Dockerfile.base", "shortDescription": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 futureagi/code-executor/Dockerfile.base"}, "fullDescription": {"text": "'RUN cd ...' to change directory\n\nRUN should not be used to change directory: 'cd /tmp     && git clone --depth 1 --branch 3.4 https://github.com/google/nsjail.git     && cd nsjail     && make -j$(nproc)     && cp nsjail /usr/local/bin/     && cd / && rm -rf /tmp/nsjail'. Use 'WORKDIR' statement instead.\n\nRule: DS-0013\nSeverity: MEDIUM\nTarget: futureagi/code-executor/Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8bb1c7c5f54f2ec", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/code-executor/Dockerfile.base", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/code-executor/Dockerfile.base"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/code-executor/Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc15f9de493868c6", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/model_serving/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-991da9034178614f", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/model_serving/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0046e63011aea5a", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.base", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.base"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/model_serving/Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e3495690931218b", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.base", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.base"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/model_serving/Dockerfile.base"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88e1bff566a2356c", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.oss", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.oss"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/model_serving/Dockerfile.oss"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f0a19351b57fec39", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.oss", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.oss"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/model_serving/Dockerfile.oss"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5acdae3c2a2019b", "name": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.test", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.test"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: futureagi/model_serving/Dockerfile.test"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d5f9fe08116d5b2c", "name": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.test", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.test"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: futureagi/model_serving/Dockerfile.test"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fc930ee6bac175f", "name": "Secret leak: GitLab Personal Access Token \u2014 .gitleaks.toml", "shortDescription": {"text": "Secret leak: GitLab Personal Access Token \u2014 .gitleaks.toml"}, "fullDescription": {"text": "Trivy detected a possible secret in `.gitleaks.toml`.\n\nRule: gitlab-pat\nSeverity: CRITICAL\nMatch (redacted):     '''**************************''',     # literal test input for secret-detect\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9bc071e240e0a068", "name": "Secret leak: Stripe Secret Key \u2014 .gitleaks.toml", "shortDescription": {"text": "Secret leak: Stripe Secret Key \u2014 .gitleaks.toml"}, "fullDescription": {"text": "Trivy detected a possible secret in `.gitleaks.toml`.\n\nRule: stripe-secret-token\nSeverity: CRITICAL\nMatch (redacted):     '''********************************''',\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-30025757f355763f", "name": "Secret leak: Google (GCP) Service-account \u2014 frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials", "shortDescription": {"text": "Secret leak: Google (GCP) Service-account \u2014 frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials/CloudStorageCredentials.jsx"}, "fullDescription": {"text": "Trivy detected a possible secret in `frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials/CloudStorageCredentials.jsx`.\n\nRule: gcp-service-account\nSeverity: CRITICAL\nMatch (redacted):             placeholder='{*************************, ...}'\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0357e073e2a1a4fc", "name": "Secret leak: Google (GCP) Service-account \u2014 frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials", "shortDescription": {"text": "Secret leak: Google (GCP) Service-account \u2014 frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials/MessageQueueCredentials.jsx"}, "fullDescription": {"text": "Trivy detected a possible secret in `frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials/MessageQueueCredentials.jsx`.\n\nRule: gcp-service-account\nSeverity: CRITICAL\nMatch (redacted):             placeholder='{*************************, ...}'\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-662da348442b75fd", "name": "Privileged port 1000 in use", "shortDescription": {"text": "Privileged port 1000 in use"}, "fullDescription": {"text": "Port 1000 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a12dd6a25b57ed3d", "name": "Privileged port 587 in use", "shortDescription": {"text": "Privileged port 587 in use"}, "fullDescription": {"text": "Port 587 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efc74e57914c21b", "name": "Privileged port 120 in use", "shortDescription": {"text": "Privileged port 120 in use"}, "fullDescription": {"text": "Port 120 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e79c71a9813ea954", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c4c69854348bba7", "name": "Privileged port 3 in use", "shortDescription": {"text": "Privileged port 3 in use"}, "fullDescription": {"text": "Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de608e122eb77061", "name": "Docker base image is tag-pinned but not digest-pinned: futureagi/future-agi-base:v1.0.4", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/future-agi-base:v1.0.4"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08a85be64f7159f7", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.24-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.24-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81d8895dfecb8aac", "name": "Docker base image is tag-pinned but not digest-pinned: gcr.io/distroless/static-debian12:nonroot", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: gcr.io/distroless/static-debian12:nonroot"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60427b03771411b6", "name": "Dockerfile runs as root: frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca248a9abdff92ff", "name": "Docker base image is tag-pinned but not digest-pinned: node:22.18", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22.18"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b048d166901fd868", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64922ec5c36c545d", "name": "Dockerfile runs as root: futureagi/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: futureagi/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7e85f21728af454", "name": "Docker base image is tag-pinned but not digest-pinned: futureagi/future-agi-base:v1.0.4", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/future-agi-base:v1.0.4"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62bfeec7b5a13364", "name": "Dockerfile runs as root: futureagi/code-executor/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: futureagi/code-executor/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e67f53906cb2b714", "name": "Docker base image is tag-pinned but not digest-pinned: futureagi/code-executor-base:v1.0.0", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/code-executor-base:v1.0.0"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cbf405a6b50c720", "name": "Dockerfile runs as root: futureagi/model_serving/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: futureagi/model_serving/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1e51620bb5f5b02", "name": "Docker base image is tag-pinned but not digest-pinned: futureagi/serving-base:v1.0.0", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/serving-base:v1.0.0"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be0dbe47aa5bbaee", "name": "Dockerfile runs as root: agentcc-gateway/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: agentcc-gateway/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c3c4b87a149ee6a", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.26-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.26-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6b9398eceed8d46", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/test-annotation-lifecycle.mjs:758", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/test-annotation-lifecycle.mjs:758"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe508711cc1940be", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/test-annotation-rules.mjs:2659", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/test-annotation-rules.mjs:2659"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7898387b54c1ce97", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-profile-security-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-profile-security-smoke.mjs:66"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f16de277b334504e", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-usage-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-usage-smoke.mjs:66"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-113249f4c621aa83", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-users-smoke.mjs:37", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-users-smoke.mjs:37"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86140eafbf59ecbd", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-ai-providers-smo", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-ai-providers-smoke.mjs:108"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72f64fedf51e67b8", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-bulk-assign-smoke.mjs:74", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-bulk-assign-smoke.mjs:748"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70218e5501e22feb", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/get-started-smoke.mjs:84", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/get-started-smoke.mjs:84"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53cb1df648c2782c", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-ai-providers-smoke.", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-ai-providers-smoke.mjs:79"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6aab09d62cd80af", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-clone-list-action-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-clone-list-action-smoke.mjs:487"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1408d7874a76d31", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-analytics-smoke.mjs:880", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-analytics-smoke.mjs:880"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b52faa70a42ca25f", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs:126", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs:126"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c24b50da9326b6dd", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-logs-export-smoke.mjs:876", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-logs-export-smoke.mjs:876"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d7231125a40198c", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-viewer-role-write-smoke.mjs:278", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-viewer-role-write-smoke.mjs:278"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f271ae3827c5f2c", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/voice-path-analysis-smoke.mjs:248", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/voice-path-analysis-smoke.mjs:248"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef0e5ee292281152", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-add-evals-task-draft-smoke.", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-add-evals-task-draft-smoke.mjs:493"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e246852662e05ac6", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/composite-eval-create-smoke.mjs:805", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/composite-eval-create-smoke.mjs:805"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7541a12a49650b7", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-projects-smoke.mjs:83", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-projects-smoke.mjs:83"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d10497a78e8a289b", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-existing-add-as-new-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-existing-add-as-new-smoke.mjs:477"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82e3275126dc2f32", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/error-feed-smoke.mjs:46", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/error-feed-smoke.mjs:46"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8732b2a5beafbfa9", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-session-select-all-smoke.mjs:332", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-session-select-all-smoke.mjs:332"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b1366c693685e91", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-sessions-smoke.mjs:769", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-sessions-smoke.mjs:769"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efa645ba51fff08", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/tasks-smoke.mjs:79", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/tasks-smoke.mjs:79"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39edaaa3ba239629", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-api-keys-smoke.mjs:285", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-api-keys-smoke.mjs:285"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-094949378a4e7409", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-mcp-smoke.mjs:581", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-mcp-smoke.mjs:581"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-268e4b86b8fac1dc", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-file-upload-smoke.mjs:254", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-file-upload-smoke.mjs:254"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8407a284ee251e11", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-providers-smoke.mjs:376", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-providers-smoke.mjs:376"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88ba5d76d03e9ce4", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-charts-smoke.mjs:65", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-charts-smoke.mjs:65"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38f780afe6aaa70a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-copy-new-detail-smoke.mjs:4", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-copy-new-detail-smoke.mjs:498"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b73e27376945e64", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-custom-properties-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-custom-properties-smoke.mjs:535"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8b7dd62a3726f7e", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-query-share-state-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-query-share-state-smoke.mjs:108"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5f2915c238cf63f", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/error-feed-linear-connect-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/error-feed-linear-connect-smoke.mjs:190"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-277a1ecc25530c09", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-column-menu-detail-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-column-menu-detail-smoke.mjs:485"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06a063dc316acd09", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-webhooks-delivery-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-webhooks-delivery-smoke.mjs:803"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ce6232a8ec335d5", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-falcon-connectors-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-falcon-connectors-smoke.mjs:490"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3214759cba1933a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-billing-budget-crud-smoke.", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-billing-budget-crud-smoke.mjs:68"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7c8ef0ee6b64059", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-list-bulk-delete-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-list-bulk-delete-smoke.mjs:621"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f382e108a6efdeec", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-settings-mutation-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-settings-mutation-smoke.mjs:550"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7bee355a208c686", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-edit-column-type-detail-smo", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-edit-column-type-detail-smoke.mjs:442"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74d354deed7d04f5", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-budgets-smoke.mjs:502", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-budgets-smoke.mjs:502"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c567fb5d1629e62", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-session-trace-id-smoke.mjs:210", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-session-trace-id-smoke.mjs:210"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53555a1f0bcaa942", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-guardrails-smoke.mjs:414", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-guardrails-smoke.mjs:414"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9296030d5e556c1a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-filters-smoke.mjs:39", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-filters-smoke.mjs:39"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-305f44de923e82d5", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-annotation-label-columns-sm", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs:319"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cdb0a69c2ec1dab", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs:488", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs:488"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55cf94d6baba79d6", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-ee-license-crud-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-ee-license-crud-smoke.mjs:85"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43ba923dc1dea7d1", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-merge-existing-detail-smoke", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-merge-existing-detail-smoke.mjs:491"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ece95f765931b08d", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-list-detail-date-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-list-detail-date-smoke.mjs:78"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c259cab64f8539d", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-providers-mutation-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-providers-mutation-smoke.mjs:435"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d731113a173d7ded", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-submit-workflow-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-submit-workflow-smoke.mjs:36"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-455b2fe27b8f4a73", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/onboarding-logout-smoke.mjs:377", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/onboarding-logout-smoke.mjs:377"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1f439340c7b4336", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-create-duplicate-d", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-create-duplicate-drawer-smoke.mjs:621"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1dc7a5180a7618ca", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/composite-eval-smoke.mjs:81", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/composite-eval-smoke.mjs:81"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bdf4faa25df2d8d", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-duplicate-rows-detail-smoke", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-duplicate-rows-detail-smoke.mjs:461"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc8183593bf02a81", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-skills-smoke.mjs:364", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-skills-smoke.mjs:364"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e79a5568c7f44d6", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-integrations-lifecy", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-integrations-lifecycle-smoke.mjs:90"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52f2ec6410a0f72b", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-billing-pricing-licenses-s", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-billing-pricing-licenses-smoke.mjs:186"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edc59ad1e0a7c888", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/alerts-smoke.mjs:55", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/alerts-smoke.mjs:55"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e46b8b049e26595", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-annotations-preview-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-annotations-preview-smoke.mjs:552"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3d639b4612a7fb3", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-voice-smoke.mjs:39", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-voice-smoke.mjs:39"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16b9f70408067c7c", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/tasks-lifecycle-mutation-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/tasks-lifecycle-mutation-smoke.mjs:406"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e44a9debb3cc55c7", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/resources-docs-help-smoke.mjs:32", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/resources-docs-help-smoke.mjs:32"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1f0ebd6980893d6", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-integrations-smoke.", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-integrations-smoke.mjs:59"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46610cb5c37339e7", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-user-management-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-user-management-smoke.mjs:124"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0cd8b0bb7cb7f5f", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/alerts-lifecycle-mutation-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/alerts-lifecycle-mutation-smoke.mjs:55"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b01b17318dab7b5", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-charts-filter-smoke.mjs:54", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-charts-filter-smoke.mjs:54"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0297a5539778945a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-manual-create-smoke.mjs:346", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-manual-create-smoke.mjs:346"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60ffc1d8f378688d", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prompt-workbench-smoke.mjs:914", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prompt-workbench-smoke.mjs:914"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6aeb98e697ba6497", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-file-row-upload-detail-smok", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-file-row-upload-detail-smoke.mjs:882"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6907ee0698d2979e", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-projects-smoke.mjs:58", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-projects-smoke.mjs:58"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1f4a38347f1739b", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-overview-smoke.mjs:347", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-overview-smoke.mjs:347"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89705e381163e968", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-playground-versions-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-playground-versions-smoke.mjs:90"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef02b1f31ddbe2c9", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/models-route-smoke.mjs:49", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/models-route-smoke.mjs:49"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9c42e01383a4fd1", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-label-archive-restore-smoke.mjs:252", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-label-archive-restore-smoke.mjs:252"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e08d149f6dd4f879", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-session-smoke.mjs:40", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-session-smoke.mjs:40"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d17704014dd7b378", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-smoke.mjs:124", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-smoke.mjs:124"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1423b051309892f9", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-scenarios-detail-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-scenarios-detail-smoke.mjs:243"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df5102b3a74bb681", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-simulation-content-smoke.mjs:256", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-simulation-content-smoke.mjs:256"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0609cb4c48abf38", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queues-list-search-detai", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queues-list-search-detail-smoke.mjs:714"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bc4c9c23e4312ed", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-row-detail-drawer-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-row-detail-drawer-smoke.mjs:457"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-400b044a314f89ac", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-project-configure-delete-", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-project-configure-delete-smoke.mjs:347"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fa5dbc15853efc7", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-keys-smoke.mjs:455", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-keys-smoke.mjs:455"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a040f02971b0d587", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-rule-run-now-smoke.mjs:281", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-rule-run-now-smoke.mjs:281"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a71bfed2974d6cd", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-import-existing-detail-smok", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-import-existing-detail-smoke.mjs:527"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c97b08d17bd8a0b1", "name": "Possible secret in frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs", "shortDescription": {"text": "Possible secret in frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-560c31491c265b34", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs:641", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs:641"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-285f29e9a67d686d", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-mcp-mutation-smoke.mjs:589", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-mcp-mutation-smoke.mjs:589"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79e1b451937cfa8b", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-personas-lifecycle-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-personas-lifecycle-smoke.mjs:238"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba764b451cb710bf", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-fallbacks-smoke.mjs:498", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-fallbacks-smoke.mjs:498"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d62c11650631441", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-self-review-block-smoke.mjs:235", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-self-review-block-smoke.mjs:235"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd2712d3ead84290", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-detail-smoke.mjs:47", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-detail-smoke.mjs:47"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce491006503774c5", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-monitoring-mutation-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-monitoring-mutation-smoke.mjs:503"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13e246b03ee857de", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-review-flow-smoke.mjs:380", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-review-flow-smoke.mjs:380"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9d817c11c0b6cee", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-run-detail-actions-smoke.", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-run-detail-actions-smoke.mjs:561"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49e22baab0e797f8", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-direct-call-queue-source-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-direct-call-queue-source-smoke.mjs:275"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90df4fadac00d0ae", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-trace-full-page-smoke.mjs:2", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-trace-full-page-smoke.mjs:280"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-502dd9369a275854", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-run-tests-read-smoke.mjs:3", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-run-tests-read-smoke.mjs:353"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85ab2ecdc7d15166", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-deep-smoke.spec.js:24", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-deep-smoke.spec.js:24"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7832ee9441591379", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-guardrails-mutation-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-guardrails-mutation-smoke.mjs:519"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52bdacba85125afb", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-add-static-column-detail-sm", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-add-static-column-detail-smoke.mjs:443"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7d842879a943611", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-list-create-delete-smoke.mjs:7", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-list-create-delete-smoke.mjs:762"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b815764f68834271", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-custom-models-cr", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mjs:54"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0c750da52fc80e0", "name": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mj", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mjs:277"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0489a6dfd1a8e6a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/knowledge-base-entitlement-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/knowledge-base-entitlement-smoke.mjs:47"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8af30229eaa6ea6", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-synthetic-config-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-synthetic-config-smoke.mjs:859"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b91cab38af23b2e", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-ground-truth-smoke.mjs:62", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-ground-truth-smoke.mjs:62"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7545014cee193e4", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-widget-editor-smoke.mjs:8", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-widget-editor-smoke.mjs:81"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5f5c7d6d2062620", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-agent-definitions-lifecycl", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-agent-definitions-lifecycle-smoke.mjs:341"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0134ce50620c5c2f", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-groups-smoke.mjs:57", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-groups-smoke.mjs:57"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e27f27adf3dea37c", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-workspace-layout-smoke.m", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-workspace-layout-smoke.mjs:37"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fe3971373feba12", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-annotations-feedback-smoke.", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-annotations-feedback-smoke.mjs:216"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bab7c83d99ba94a5", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-export-download-sm", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-export-download-smoke.mjs:411"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ea95dd6028c3971", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-budgets-mutation-smoke.mjs:", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-budgets-mutation-smoke.mjs:490"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75ceabeae28772ee", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-list-create-delete-smoke.mjs", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-list-create-delete-smoke.mjs:362"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b0484406a9d40f4", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-integrations-smo", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-integrations-smoke.mjs:76"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff928ca0f43b390e", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-metrics-panels-smo", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-metrics-panels-smoke.mjs:732"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d76cc7b7eaac2bb7", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-conversation-smoke.mjs:44", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-conversation-smoke.mjs:446"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ec0502254eb8db4", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-mcp-server-smoke.mjs:55", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-mcp-server-smoke.mjs:55"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96c60efed8aac495", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-project-create-delete-smo", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-project-create-delete-smoke.mjs:344"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0da5ff9e85e016fa", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-fallbacks-mutation-smoke.mj", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-fallbacks-mutation-smoke.mjs:596"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9734111c1349a041", "name": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-monitoring-smoke.mjs:562", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-monitoring-smoke.mjs:562"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a6ccd01adb69f2c", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/context/jwt/utils.js:40", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/context/jwt/utils.js:40"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccbc64e56231ab1a", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/context/jwt/auth-provider.jsx:219", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/context/jwt/auth-provider.jsx:219"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d28b1fc7630e115", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/guard/auth-guard.jsx:64", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/guard/auth-guard.jsx:64"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffd16d04cd2f2fa1", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/utils/axios.js:183", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/utils/axios.js:183"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1822b47adb7b3ed7", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/src/components/traceDetail/SpanDetailPane.jsx:120", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/components/traceDetail/SpanDetailPane.jsx:120"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-c66af49d30717fb7", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/pages/SOSLoginPage.jsx:20", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/pages/SOSLoginPage.jsx:20"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00eaaf5b47b76afc", "name": "Insecure pattern 'domparser_html_parse' in frontend/src/sections/prompt/PromptBox/InputPromptBoxV3.jsx:45", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/sections/prompt/PromptBox/InputPromptBoxV3.jsx:45"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-977a75e6192d345b", "name": "Insecure pattern 'python_os_system' in frontend/src/sections/evals/components/CodeEvalEditor.jsx:180", "shortDescription": {"text": "Insecure pattern 'python_os_system' in frontend/src/sections/evals/components/CodeEvalEditor.jsx:180"}, "fullDescription": {"text": "Found a known-risky pattern (python_os_system). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1275bb76e6fcec49", "name": "Possible secret in frontend/src/hooks/use-mocked-user.js", "shortDescription": {"text": "Possible secret in frontend/src/hooks/use-mocked-user.js"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-6482890cdb2876ef", "name": "Possible secret in futureagi/conftest.py", "shortDescription": {"text": "Possible secret in futureagi/conftest.py"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-ce2cea8a363ed516", "name": "Possible secret in futureagi/agent_playground/tests/conftest.py", "shortDescription": {"text": "Possible secret in futureagi/agent_playground/tests/conftest.py"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-d0f07c077549972f", "name": "Possible secret in futureagi/scripts/property_catalog_oss/bootstrap_postgres.sh", "shortDescription": {"text": "Possible secret in futureagi/scripts/property_catalog_oss/bootstrap_postgres.sh"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-3e4f1cc7a2fac49f", "name": "Insecure pattern 'tls_verify_false' in futureagi/accounts/gcp_marketplace_utils.py:85", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in futureagi/accounts/gcp_marketplace_utils.py:85"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97cacb362324a5fc", "name": "Possible secret in futureagi/tfc/temporal/agent_playground/tests/conftest.py", "shortDescription": {"text": "Possible secret in futureagi/tfc/temporal/agent_playground/tests/conftest.py"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-6966d3f6d6fb5b13", "name": "Possible secret in futureagi/tfc/temporal/experiments/tests/conftest.py", "shortDescription": {"text": "Possible secret in futureagi/tfc/temporal/experiments/tests/conftest.py"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-3a00ce3ff2d2eebc", "name": "Insecure pattern 'exec_used' in futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py:257", "shortDescription": {"text": "Insecure pattern 'exec_used' in futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py:257"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36520a0f6bfd2a7b", "name": "Possible secret in futureagi/tracer/tests/integration/conftest.py", "shortDescription": {"text": "Possible secret in futureagi/tracer/tests/integration/conftest.py"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-0118bdc73b9d08a8", "name": "Possible secret in futureagi/tracer/tests/integration/_seed.py", "shortDescription": {"text": "Possible secret in futureagi/tracer/tests/integration/_seed.py"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-bbccb25ef9ea4477", "name": "Insecure pattern 'eval_used' in futureagi/ee/falcon_ai/builtin_skills/fix-with-falcon.yaml:142", "shortDescription": {"text": "Insecure pattern 'eval_used' in futureagi/ee/falcon_ai/builtin_skills/fix-with-falcon.yaml:142"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0de6dc1f058f77e9", "name": "Insecure pattern 'cors_wildcard' in agentcc-gateway/internal/middleware/cors.go:100", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in agentcc-gateway/internal/middleware/cors.go:100"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e7271110d5e31c3", "name": "Insecure pattern 'eval_used' in agentcc-gateway/internal/guardrails/expression/expression.go:55", "shortDescription": {"text": "Insecure pattern 'eval_used' in agentcc-gateway/internal/guardrails/expression/expression.go:55"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e44de735fae4f837", "name": "Insecure pattern 'exec_used' in agentcc-gateway/internal/guardrails/mcpsec/toolguard_test.go:81", "shortDescription": {"text": "Insecure pattern 'exec_used' in agentcc-gateway/internal/guardrails/mcpsec/toolguard_test.go:81"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dff04bbb5f03a528", "name": "Insecure pattern 'exec_used' in agentcc-gateway/internal/guardrails/mcpsec/mcpsec_test.go:214", "shortDescription": {"text": "Insecure pattern 'exec_used' in agentcc-gateway/internal/guardrails/mcpsec/mcpsec_test.go:214"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-23d8d46b7a1ab200", "name": "Possible secret in agentcc-gateway/internal/guardrails/secrets/secrets_test.go", "shortDescription": {"text": "Possible secret in agentcc-gateway/internal/guardrails/secrets/secrets_test.go"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching github_token. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.99}}, {"id": "scanner-3bedb1654eef4748", "name": "Insecure pattern 'weak_hash' in agentcc-gateway/internal/cache/backend_azblob.go:197", "shortDescription": {"text": "Insecure pattern 'weak_hash' in agentcc-gateway/internal/cache/backend_azblob.go:197"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c9e34148a972152", "name": "Insecure pattern 'eval_used' in e2e/flows/observe/graph-metric-scoping.spec.ts:141", "shortDescription": {"text": "Insecure pattern 'eval_used' in e2e/flows/observe/graph-metric-scoping.spec.ts:141"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85672b8ac5b40d0c", "name": "Insecure pattern 'local_storage_auth_token' in e2e/lib/auth.ts:7", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in e2e/lib/auth.ts:7"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8b4acf461c6fdb0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "hmarr/auto-approve-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-478a3bc374f5d2bb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "hmarr/auto-approve-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91ba379b9c200873", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04efab929fdad8b3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/build-push-action@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbe310f193a6df9f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0c3b23d8a43a55e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86b175677347f077", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0bc52d7c3302767", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2869f9f5a62a937e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94555377f6661d3b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a2fe1ff681f384d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f26d035c99748ab", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "docker/build-push-action@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7a64e431e659190", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-975f27e3804c7491", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dorny/paths-filter@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efffd648a33c5dc1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfda159126dca791", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce0ddc37b6e997f9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc122733f7b52e90", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8355bdc1ce844cbb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8be3e52b87df4e5c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0921e7e28a7b390c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dorny/paths-filter@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8febc47d818b60c4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c853bff7865db66", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "hmarr/auto-approve-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da29cd913cf8a314", "name": "Very large file: fi-collector/pkg/propertycatalog/checkpoint_loader.go (1795 lines)", "shortDescription": {"text": "Very large file: fi-collector/pkg/propertycatalog/checkpoint_loader.go (1795 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfbbc2ebeff32f33", "name": "Very large file: fi-collector/pkg/propertycatalog/checkpoint_loader_test.go (1506 lines)", "shortDescription": {"text": "Very large file: fi-collector/pkg/propertycatalog/checkpoint_loader_test.go (1506 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67cd21bd86d49c74", "name": "Very large file: frontend/scripts/test-annotation-rules.mjs (2761 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/test-annotation-rules.mjs (2761 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dacd933048e4f3ca", "name": "Very large file: frontend/scripts/api-journeys/journeys/public-api.mjs (6548 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/journeys/public-api.mjs (6548 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7727218cc938a68", "name": "Very large file: frontend/scripts/api-journeys/journeys/observe-filters.mjs (13658 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/journeys/observe-filters.mjs (13658 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69acde7748dc549e", "name": "Very large file: frontend/scripts/api-journeys/journeys/agent-playground.mjs (2759 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/journeys/agent-playground.mjs (2759 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc191d84b9f2d407", "name": "Very large file: frontend/scripts/api-journeys/journeys/app-core.mjs (20088 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/journeys/app-core.mjs (20088 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-269853eabd7a00c9", "name": "Very large file: frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs (14761 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs (14761 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef1a3830267db399", "name": "Very large file: frontend/scripts/api-journeys/journeys/annotation-queues.mjs (16139 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/journeys/annotation-queues.mjs (16139 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39a6e26e79d7e861", "name": "Very large file: frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs (1884 lines)", "shortDescription": {"text": "Very large file: frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs (1884 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13a6290421da8e3c", "name": "Very large file: frontend/src/generated/api-contracts/api.schemas.ts (32500 lines)", "shortDescription": {"text": "Very large file: frontend/src/generated/api-contracts/api.schemas.ts (32500 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c64385dd6ba6ed5e", "name": "Very large file: frontend/src/api/annotation-queues/annotation-queues.js (1973 lines)", "shortDescription": {"text": "Very large file: frontend/src/api/annotation-queues/annotation-queues.js (1973 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-613b1d504d03c4be", "name": "Very large file: frontend/src/api/annotation-queues/__tests__/annotation-queues.test.js (2183 lines)", "shortDescription": {"text": "Very large file: frontend/src/api/annotation-queues/__tests__/annotation-queues.test.js (2183 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-692fefa100a046c3", "name": "Very large file: frontend/src/api/contracts/api-surface.generated.js (2406 lines)", "shortDescription": {"text": "Very large file: frontend/src/api/contracts/api-surface.generated.js (2406 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e621280437b29d7", "name": "Very large file: frontend/src/utils/axios.js (2193 lines)", "shortDescription": {"text": "Very large file: frontend/src/utils/axios.js (2193 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-005c24c972255991", "name": "Very large file: frontend/src/components/filter-panel/FilterPanel.jsx (2165 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/filter-panel/FilterPanel.jsx (2165 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa917aee2c7a5cf2", "name": "Very large file: frontend/src/components/VoiceDetailDrawerV2/PathAnalysisView.jsx (1667 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/VoiceDetailDrawerV2/PathAnalysisView.jsx (1667 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6099f4d1b97753e", "name": "Very large file: frontend/src/components/traceDetail/SpanDetailPane.jsx (2798 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/traceDetail/SpanDetailPane.jsx (2798 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee44dc94ba05f917", "name": "Very large file: frontend/src/components/traceDetail/TraceDetailDrawerV2.jsx (1555 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/traceDetail/TraceDetailDrawerV2.jsx (1555 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-325827a0a9e4bf09", "name": "Very large file: frontend/src/components/three/umap.jsx (2194 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/three/umap.jsx (2194 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c0423a38dfc666f", "name": "Very large file: frontend/src/components/run-tests/CreateRunTestPage.jsx (2389 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/run-tests/CreateRunTestPage.jsx (2389 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eecc5fb6383cee43", "name": "Very large file: frontend/src/pages/dashboard/error-feed/components/AnalyzeTab.jsx (1737 lines)", "shortDescription": {"text": "Very large file: frontend/src/pages/dashboard/error-feed/components/AnalyzeTab.jsx (1737 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd95bbf59a812764", "name": "Very large file: frontend/src/pages/dashboard/error-feed/components/OverviewTab.jsx (2806 lines)", "shortDescription": {"text": "Very large file: frontend/src/pages/dashboard/error-feed/components/OverviewTab.jsx (2806 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eae3f32effaee181", "name": "Very large file: frontend/src/pages/dashboard/harness/HarnessCreate.jsx (1635 lines)", "shortDescription": {"text": "Very large file: frontend/src/pages/dashboard/harness/HarnessCreate.jsx (1635 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db209e5514aa318d", "name": "Very large file: frontend/src/sections/projects/LLMTracing/TraceFilterPanel.jsx (5406 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/TraceFilterPanel.jsx (5406 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98e1a68efff6414f", "name": "Very large file: frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx (5307 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx (5307 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34e12c14c377988f", "name": "Very large file: frontend/src/sections/projects/LLMTracing/__tests__/listCursorPagination.test.js (1789 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/__tests__/listCursorPagination.test.js (1789 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f52e82d01115f69", "name": "Very large file: frontend/src/sections/projects/LLMTracing/__tests__/TraceFilterPanel.test.jsx (6891 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/__tests__/TraceFilterPanel.test.jsx (6891 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-134545916828176e", "name": "Very large file: frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx (1616 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx (1616 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-234f2930eab32af2", "name": "Very large file: frontend/src/sections/common/EvalPicker/EvalPickerConfigFull.jsx (2311 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/common/EvalPicker/EvalPickerConfigFull.jsx (2311 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fc0ca07d95eb88f", "name": "Very large file: frontend/src/sections/common/EvalPicker/EvalPickerCreateNew.jsx (1495 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/common/EvalPicker/EvalPickerCreateNew.jsx (1495 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b428b222f16989bc", "name": "Very large file: frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx (2421 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx (2421 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-298d63c0b30b402c", "name": "Very large file: frontend/src/sections/develop-detail/DataTab/DatapointDrawerV2/DatapointDrawerV2.jsx (1729 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/develop-detail/DataTab/DatapointDrawerV2/DatapointDrawerV2.jsx (1729 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c27cfb2d02007a53", "name": "Very large file: frontend/src/sections/dashboards/WidgetEditorView.jsx (8014 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/dashboards/WidgetEditorView.jsx (8014 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f849ec0d09dd8506", "name": "Very large file: frontend/src/sections/dashboards/DashboardDetailView.jsx (1808 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/dashboards/DashboardDetailView.jsx (1808 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4104c4e246198d65", "name": "Very large file: frontend/src/sections/dashboards/WidgetChart.jsx (1562 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/dashboards/WidgetChart.jsx (1562 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3dbd166ae6b93b0d", "name": "Very large file: frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx (1741 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx (1741 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ece8a46def930a8", "name": "Very large file: frontend/src/sections/tasks/components/TaskLivePreview.jsx (1805 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/tasks/components/TaskLivePreview.jsx (1805 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60d7c613798317d9", "name": "Very large file: frontend/src/sections/tasks/components/__tests__/TaskLivePreview.cursor.test.jsx (2284 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/tasks/components/__tests__/TaskLivePreview.cursor.test.jsx (2284 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7acb38100b12f9c0", "name": "Very large file: frontend/src/sections/annotations/queues/__tests__/annotate-components.test.jsx (3431 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/annotations/queues/__tests__/annotate-components.test.jsx (3431 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4677c4c5a0a8ceb", "name": "Very large file: frontend/src/sections/annotations/queues/annotate/annotation-comparison-panel.jsx (2202 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/annotations/queues/annotate/annotation-comparison-panel.jsx (2202 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-597e7b1c796c0aba", "name": "Very large file: frontend/src/sections/annotations/queues/annotate/discussion-panel.jsx (2783 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/annotations/queues/annotate/discussion-panel.jsx (2783 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32e4240d97a5627b", "name": "Very large file: frontend/src/sections/annotations/queues/annotate/annotate-workspace-view.jsx (1831 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/annotations/queues/annotate/annotate-workspace-view.jsx (1831 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-982975cfe7b31d22", "name": "Very large file: frontend/src/sections/annotations/queues/items/add-items-dialog.jsx (5046 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/annotations/queues/items/add-items-dialog.jsx (5046 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa4fc455a627ba27", "name": "Very large file: frontend/src/sections/falcon-ai/components/CustomizePanel.jsx (2555 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/falcon-ai/components/CustomizePanel.jsx (2555 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f873b03a133e0d6", "name": "Very large file: frontend/src/sections/gateway/settings/RoutingConfigTab.jsx (1796 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/gateway/settings/RoutingConfigTab.jsx (1796 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d5352893f13b4a7", "name": "Very large file: frontend/src/sections/evals/components/TracingTestMode.jsx (2538 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/TracingTestMode.jsx (2538 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-623b7cb36b4d862f", "name": "Very large file: frontend/src/sections/evals/components/EvalCreatePage.jsx (1553 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/EvalCreatePage.jsx (1553 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92f8077bbd5d8e0b", "name": "Very large file: frontend/src/sections/evals/components/ModelSelector.jsx (1966 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/ModelSelector.jsx (1966 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf4a8c9db0bf033a", "name": "Very large file: frontend/src/sections/evals/components/TestPlayground.jsx (1967 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/TestPlayground.jsx (1967 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c69522a94abc94b", "name": "Very large file: frontend/src/sections/evals/components/EvalDetailPage.jsx (2163 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/EvalDetailPage.jsx (2163 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36da7cd813587dc9", "name": "Very large file: frontend/src/sections/evals/components/DatasetTestMode.jsx (1967 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/DatasetTestMode.jsx (1967 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7894299c3149d4ab", "name": "Very large file: frontend/src/sections/evals/components/EvalGroundTruthTab.jsx (2175 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/EvalGroundTruthTab.jsx (2175 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bf20396632d249c", "name": "Very large file: frontend/src/sections/evals/components/SimulationTestMode.jsx (2329 lines)", "shortDescription": {"text": "Very large file: frontend/src/sections/evals/components/SimulationTestMode.jsx (2329 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a4e153b1a510a08", "name": "Very large file: frontend/src/hooks/__tests__/useDashboards.test.js (2075 lines)", "shortDescription": {"text": "Very large file: frontend/src/hooks/__tests__/useDashboards.test.js (2075 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-103ac4a7a2cabd8a", "name": "Very large file: futureagi/agent_playground/tests/serializers/test_node_serializers.py (1718 lines)", "shortDescription": {"text": "Very large file: futureagi/agent_playground/tests/serializers/test_node_serializers.py (1718 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d4be82a8e731362", "name": "Very large file: futureagi/agent_playground/tests/services/test_node_crud.py (4414 lines)", "shortDescription": {"text": "Very large file: futureagi/agent_playground/tests/services/test_node_crud.py (4414 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c76e1fb707741779", "name": "Very large file: futureagi/agent_playground/tests/views/test_graph_views.py (2272 lines)", "shortDescription": {"text": "Very large file: futureagi/agent_playground/tests/views/test_graph_views.py (2272 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ff7e603a32b02c9", "name": "Very large file: futureagi/agent_playground/tests/views/test_node_views.py (1709 lines)", "shortDescription": {"text": "Very large file: futureagi/agent_playground/tests/views/test_node_views.py (1709 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d92bb0c3c99fbe9", "name": "Very large file: futureagi/model_hub/tests/test_custom_models_api.py (1706 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_custom_models_api.py (1706 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b3df9e81a0353c1", "name": "Very large file: futureagi/model_hub/tests/test_develop_annotations_api.py (1651 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_develop_annotations_api.py (1651 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f5feb4c9ad321f7", "name": "Very large file: futureagi/model_hub/tests/test_experiment_api.py (1943 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_experiment_api.py (1943 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77a917ceabf9ae1a", "name": "Very large file: futureagi/model_hub/tests/test_voice_annotation_regressions_e2e.py (2860 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_voice_annotation_regressions_e2e.py (2860 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fa34ac3f2e68e49", "name": "Very large file: futureagi/model_hub/tests/test_annotation_workflow_api.py (7062 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_workflow_api.py (7062 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-226b40476921100b", "name": "Very large file: futureagi/model_hub/tests/test_annotation_e2e_gaps.py (1581 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_e2e_gaps.py (1581 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2c6d55b517c5499", "name": "Very large file: futureagi/model_hub/tests/test_team_a_annotations_full_matrix.py (3223 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_team_a_annotations_full_matrix.py (3223 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1052c2057ef23e75", "name": "Very large file: futureagi/model_hub/tests/test_scores_api.py (1658 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_scores_api.py (1658 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5ce9a8ab05f7c5b", "name": "Very large file: futureagi/model_hub/tests/test_eval_runner.py (1696 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_eval_runner.py (1696 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a253c65ae3d62de", "name": "Very large file: futureagi/model_hub/tests/test_evaluation_api.py (2595 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_evaluation_api.py (2595 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-810af3fa5f77eb2e", "name": "Very large file: futureagi/model_hub/tests/test_annotation_queues_api.py (1413 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_queues_api.py (1413 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa18ff3a58eceda0", "name": "Very large file: futureagi/model_hub/tests/test_experiment_v2_feedback.py (1519 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_experiment_v2_feedback.py (1519 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0577642302fbb129", "name": "Very large file: futureagi/model_hub/tests/test_ch25_annotation_collector_source_resolution.py (1304 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_ch25_annotation_collector_source_resolution.py (1304 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-436fb47c1df87f44", "name": "Very large file: futureagi/model_hub/tests/test_user_evaluation_tasks.py (1620 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_user_evaluation_tasks.py (1620 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ee3d2b4fbf7b8f1", "name": "Very large file: futureagi/model_hub/tests/test_eval_versioning.py (1990 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_eval_versioning.py (1990 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb4f3c25add4e513", "name": "Very large file: futureagi/model_hub/tests/test_automation_rules_e2e.py (3438 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_automation_rules_e2e.py (3438 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b9da37c0046a96c", "name": "Very large file: futureagi/model_hub/tests/test_dataset_bulk_add_items_filter.py (1827 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_dataset_bulk_add_items_filter.py (1827 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d10b46fa6958e083", "name": "Very large file: futureagi/model_hub/tests/test_annotation_advanced_api.py (1562 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_advanced_api.py (1562 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd59f18abf79ca17", "name": "Very large file: futureagi/model_hub/tests/test_annotation_queues_api_errors.py (1770 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_queues_api_errors.py (1770 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-738b7358a81ba6c9", "name": "Very large file: futureagi/model_hub/tests/test_dataset_dynamic_columns.py (1354 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_dataset_dynamic_columns.py (1354 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d7d18c268d8c9e0", "name": "Very large file: futureagi/model_hub/tests/test_run_prompt_api.py (3655 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tests/test_run_prompt_api.py (3655 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a5a97a4f1d0ccd1", "name": "Very large file: futureagi/model_hub/utils/SQL_queries.py (1573 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/utils/SQL_queries.py (1573 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd036dcf42e6f105", "name": "Very large file: futureagi/model_hub/utils/evals.py (3216 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/utils/evals.py (3216 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fadc2f5362b6e4a6", "name": "Very large file: futureagi/model_hub/utils/annotation_queue_helpers.py (3631 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/utils/annotation_queue_helpers.py (3631 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf1552074339731b", "name": "Very large file: futureagi/model_hub/tasks/user_evaluation.py (1473 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/tasks/user_evaluation.py (1473 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d965365f8a21b100", "name": "Very large file: futureagi/model_hub/serializers/annotation_queues.py (2009 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/serializers/annotation_queues.py (2009 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b34fda2629f41110", "name": "Very large file: futureagi/model_hub/serializers/contracts.py (3370 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/serializers/contracts.py (3370 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-126d04b7c8835c84", "name": "Very large file: futureagi/model_hub/services/bulk_selection.py (1815 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/services/bulk_selection.py (1815 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-609b5184adc7e941", "name": "Very large file: futureagi/model_hub/services/dataset_service.py (1678 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/services/dataset_service.py (1678 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d6e16b7a23215ab", "name": "Very large file: futureagi/model_hub/migrations/0001_initial.py (883 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/migrations/0001_initial.py (883 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e600def0428138d", "name": "Very large file: futureagi/model_hub/views/experiments.py (6376 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/experiments.py (6376 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2775cfd9bab2ffa6", "name": "Very large file: futureagi/model_hub/views/annotation_queues.py (8295 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/annotation_queues.py (8295 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55274c38a8d95c08", "name": "Very large file: futureagi/model_hub/views/optimize_dataset.py (1695 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/optimize_dataset.py (1695 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ca00fab9f210f8c", "name": "Very large file: futureagi/model_hub/views/eval_runner.py (3643 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/eval_runner.py (3643 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ea59c9849ddff87", "name": "Very large file: futureagi/model_hub/views/experiment_runner.py (2053 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/experiment_runner.py (2053 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c37d5f328149ed87", "name": "Very large file: futureagi/model_hub/views/ai_filter.py (2113 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/ai_filter.py (2113 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-570c2ee88ae65ed4", "name": "Very large file: futureagi/model_hub/views/dynamic_columns.py (3579 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/dynamic_columns.py (3579 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba327e4396d62c29", "name": "Very large file: futureagi/model_hub/views/run_prompt.py (2869 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/run_prompt.py (2869 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84042cc0512c4f9a", "name": "Very large file: futureagi/model_hub/views/develop_annotations.py (2291 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/develop_annotations.py (2291 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-395376099e04cd91", "name": "Very large file: futureagi/model_hub/views/prompt_template.py (4487 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/prompt_template.py (4487 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce3a9e560d64d9c7", "name": "Very large file: futureagi/model_hub/views/develop_dataset.py (16889 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/develop_dataset.py (16889 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-271135db8c2a9538", "name": "Very large file: futureagi/model_hub/views/separate_evals.py (8379 lines)", "shortDescription": {"text": "Very large file: futureagi/model_hub/views/separate_evals.py (8379 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa7afb919be135e4", "name": "Very large file: futureagi/simulate/tests/test_temporal_activities.py (2311 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_temporal_activities.py (2311 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58d16f50f18106a4", "name": "Very large file: futureagi/simulate/tests/test_e2e_prompt_simulation.py (1435 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_e2e_prompt_simulation.py (1435 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f113e74950ee763", "name": "Very large file: futureagi/simulate/tests/test_eval_resolver_behavior.py (1465 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_eval_resolver_behavior.py (1465 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac1a2412ce9f4d75", "name": "Very large file: futureagi/simulate/tests/test_hosted_harness_gateway.py (1740 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_hosted_harness_gateway.py (1740 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ebce91307b0ed5f", "name": "Very large file: futureagi/simulate/tests/test_agent_definition_api.py (1369 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_agent_definition_api.py (1369 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a8882587fd3e84f", "name": "Very large file: futureagi/simulate/tests/test_chat_simulation.py (1862 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_chat_simulation.py (1862 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff925364d233dc89", "name": "Very large file: futureagi/simulate/tests/test_scenarios_api.py (2007 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_scenarios_api.py (2007 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-748b6c1de1c45ed8", "name": "Very large file: futureagi/simulate/tests/test_alk_simulate_ingestion.py (6397 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_alk_simulate_ingestion.py (6397 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15960012a8c60b41", "name": "Very large file: futureagi/simulate/tests/test_rerun_api.py (1668 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_rerun_api.py (1668 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-799d2df3758f840c", "name": "Very large file: futureagi/simulate/tests/test_run_test_list_api.py (2296 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/tests/test_run_test_list_api.py (2296 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d6535e0dad475f3", "name": "Very large file: futureagi/simulate/utils/test_execution_utils.py (1519 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/utils/test_execution_utils.py (1519 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6847d000343c406d", "name": "Very large file: futureagi/simulate/temporal/activities/xl.py (1893 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/temporal/activities/xl.py (1893 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdeba1ecf319e269", "name": "Very large file: futureagi/simulate/serializers/test_execution.py (1889 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/serializers/test_execution.py (1889 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e89e7de2de79117", "name": "Very large file: futureagi/simulate/services/hosted_runner.py (1298 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/services/hosted_runner.py (1298 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ef84aa6b5a719c9", "name": "Very large file: futureagi/simulate/services/alk_simulate_ingestion.py (1780 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/services/alk_simulate_ingestion.py (1780 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97755f2c02ac6752", "name": "Very large file: futureagi/simulate/services/hosted_harness_gateway.py (3440 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/services/hosted_harness_gateway.py (3440 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d985fcf76644981", "name": "Very large file: futureagi/simulate/services/test_executor.py (5740 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/services/test_executor.py (5740 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d92ac188a6c58178", "name": "Very large file: futureagi/simulate/views/scenarios.py (1768 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/views/scenarios.py (1768 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c2fc3849fd8b89", "name": "Very large file: futureagi/simulate/views/run_test.py (8319 lines)", "shortDescription": {"text": "Very large file: futureagi/simulate/views/run_test.py (8319 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cba8893791d1c7c6", "name": "Very large file: futureagi/accounts/disposable_domains.py (8741 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/disposable_domains.py (8741 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d2386319df9e12e", "name": "Very large file: futureagi/accounts/user_onboard.py (4536 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/user_onboard.py (4536 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6cb5fdfb4544a99", "name": "Very large file: futureagi/accounts/tests/test_org_e2e.py (1517 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/tests/test_org_e2e.py (1517 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69e75e2919b9cc41", "name": "Very large file: futureagi/accounts/tests/test_signup.py (2308 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/tests/test_signup.py (2308 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e450361c142b062a", "name": "Very large file: futureagi/accounts/tests/test_e2e_role_and_removal.py (1602 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/tests/test_e2e_role_and_removal.py (1602 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5b472350269f13e", "name": "Very large file: futureagi/accounts/views/rbac_views.py (1375 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/views/rbac_views.py (1375 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d625f574849bfe5d", "name": "Very large file: futureagi/accounts/views/workspace_management.py (2485 lines)", "shortDescription": {"text": "Very large file: futureagi/accounts/views/workspace_management.py (2485 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83e9f0bb87a7cb97", "name": "Very large file: futureagi/agentcc/tests/test_api.py (2249 lines)", "shortDescription": {"text": "Very large file: futureagi/agentcc/tests/test_api.py (2249 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25053bc6d433bc50", "name": "Very large file: futureagi/agentcc/views/gateway.py (1642 lines)", "shortDescription": {"text": "Very large file: futureagi/agentcc/views/gateway.py (1642 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71bff0d4c14ddbf4", "name": "Very large file: futureagi/tfc/settings/settings.py (2144 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/settings/settings.py (2144 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee1cc16c8148f8b1", "name": "Very large file: futureagi/tfc/tests/test_model_hub_api_contract_debt.py (1682 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/tests/test_model_hub_api_contract_debt.py (1682 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57919b2b1bbc8cc3", "name": "Very large file: futureagi/tfc/utils/storage.py (2199 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/utils/storage.py (2199 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5db6bc0e9dbfd3ef", "name": "Very large file: futureagi/tfc/utils/error_codes.py (1330 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/utils/error_codes.py (1330 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba515a2dfa927ca4", "name": "Very large file: futureagi/tfc/temporal/agent_playground/tests/test_e2e_workflow.py (1632 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/temporal/agent_playground/tests/test_e2e_workflow.py (1632 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef4f91e7639eb130", "name": "Very large file: futureagi/tfc/temporal/simulate/activities.py (5352 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/temporal/simulate/activities.py (5352 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-302cd442ece991cf", "name": "Very large file: futureagi/tfc/temporal/experiments/activities.py (2833 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/temporal/experiments/activities.py (2833 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9d4cdfef5787cba", "name": "Very large file: futureagi/tfc/temporal/experiments/workflows.py (1648 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/temporal/experiments/workflows.py (1648 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a9c85888f068387", "name": "Very large file: futureagi/tfc/management/commands/seed_dummy_data.py (1512 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/management/commands/seed_dummy_data.py (1512 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c170c32ed82d53", "name": "Very large file: futureagi/tfc/telemetry/instrumentation.py (1797 lines)", "shortDescription": {"text": "Very large file: futureagi/tfc/telemetry/instrumentation.py (1797 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75878576aaf803c1", "name": "Very large file: futureagi/mcp_server/tests/test_mcp_e2e.py (1488 lines)", "shortDescription": {"text": "Very large file: futureagi/mcp_server/tests/test_mcp_e2e.py (1488 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a108626805ba02d4", "name": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/litellm_response.py (3455 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/litellm_response.py (3455 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5de563260d6a4a24", "name": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/available_models.py (7488 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/available_models.py (7488 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e8c88bf78844120", "name": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/tests/test_live_all_providers.py (2244 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/tests/test_live_all_providers.py (2244 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0c1afc19a73e95f", "name": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/tests/test_run_prompt.py (1563 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/tests/test_run_prompt.py (1563 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-226a208867b47484", "name": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/runprompt_handlers/tests/test_handlers.py (2173 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/runprompt_handlers/tests/test_handlers.py (2173 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4c1fede16d07bfb", "name": "Very large file: futureagi/agentic_eval/core_evals/fi_evals/function/functions.py (4103 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core_evals/fi_evals/function/functions.py (4103 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50fd83cf64b8162d", "name": "Very large file: futureagi/agentic_eval/core/embeddings/embedding_manager.py (1609 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core/embeddings/embedding_manager.py (1609 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87f6952daef44752", "name": "Very large file: futureagi/agentic_eval/core/llm/llm.py (2322 lines)", "shortDescription": {"text": "Very large file: futureagi/agentic_eval/core/llm/llm.py (2322 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-914129673ccf8765", "name": "Very large file: futureagi/tracer/tests/test_trace.py (1517 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_trace.py (1517 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9db2589fa6932fe7", "name": "Very large file: futureagi/tracer/tests/test_dashboard.py (13641 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_dashboard.py (13641 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdfe23b774915a02", "name": "Very large file: futureagi/tracer/tests/test_bounded_trace_filter_reads.py (16103 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_bounded_trace_filter_reads.py (16103 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e6d1290d26a5f1c", "name": "Very large file: futureagi/tracer/tests/test_dashboard_exact_candidate_optimization.py (1344 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_dashboard_exact_candidate_optimization.py (1344 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-220758dbbbfc0023", "name": "Very large file: futureagi/tracer/tests/test_eval_task_bounded_selector.py (3220 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_eval_task_bounded_selector.py (3220 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54986fc06100f3c1", "name": "Very large file: futureagi/tracer/tests/test_trace_session.py (3614 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_trace_session.py (3614 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05c28ca5d6f1aea5", "name": "Very large file: futureagi/tracer/tests/test_bounded_filter_key_ch25.py (3542 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_bounded_filter_key_ch25.py (3542 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-027d6a8272486a17", "name": "Very large file: futureagi/tracer/tests/test_attribute_reads_recut.py (14336 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_attribute_reads_recut.py (14336 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b88bcc1e447749c3", "name": "Very large file: futureagi/tracer/tests/test_session_user_candidate_reads.py (2747 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_session_user_candidate_reads.py (2747 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-241bbc0298196cbf", "name": "Very large file: futureagi/tracer/tests/test_voice_call_annotation_filters.py (1797 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_voice_call_annotation_filters.py (1797 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c531d22ea7d721f", "name": "Very large file: futureagi/tracer/tests/test_clickhouse.py (10158 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_clickhouse.py (10158 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b78e46e47b09654", "name": "Very large file: futureagi/tracer/tests/test_property_catalog_dev_rollout.py (3020 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_property_catalog_dev_rollout.py (3020 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-751c80629d97ef41", "name": "Very large file: futureagi/tracer/tests/test_filter_serializer_contracts.py (1526 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_filter_serializer_contracts.py (1526 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-163fbc0c7c488611", "name": "Very large file: futureagi/tracer/tests/test_retell_poll_orchestration.py (4249 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_retell_poll_orchestration.py (4249 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dbe2c4fd471bf0c", "name": "Very large file: futureagi/tracer/tests/test_property_catalog_durable_lifecycle.py (1660 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_property_catalog_durable_lifecycle.py (1660 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d33ece04382be199", "name": "Very large file: futureagi/tracer/tests/test_exact_graph_anchor_partition.py (1592 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_exact_graph_anchor_partition.py (1592 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-824d4e8939df3903", "name": "Very large file: futureagi/tracer/tests/test_bounded_graph_reads.py (4764 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_bounded_graph_reads.py (4764 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a9365cff1bcebcc", "name": "Very large file: futureagi/tracer/tests/test_session_list_bounded_view.py (1755 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_session_list_bounded_view.py (1755 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d10ee9a5b91308", "name": "Very large file: futureagi/tracer/tests/test_observation_span.py (1462 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_observation_span.py (1462 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-964920f2970becc0", "name": "Very large file: futureagi/tracer/tests/test_continuous_eval_task_contract.py (2150 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_continuous_eval_task_contract.py (2150 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14746a6a309a5c75", "name": "Very large file: futureagi/tracer/tests/test_user_list_cursor.py (1627 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_user_list_cursor.py (1627 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eaa6b601bbbec49e", "name": "Very large file: futureagi/tracer/tests/test_observability_providers.py (2537 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_observability_providers.py (2537 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48906881ccfff484", "name": "Very large file: futureagi/tracer/tests/test_exact_aggregation_contract.py (8071 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/test_exact_aggregation_contract.py (8071 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87898a4f7c7f0de6", "name": "Very large file: futureagi/tracer/tests/adapters/test_e2e_adapters.py (1584 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/tests/adapters/test_e2e_adapters.py (1584 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab50ba2a7f8dfe89", "name": "Very large file: futureagi/tracer/utils/eval.py (4392 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/utils/eval.py (4392 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c1556bfd2401732", "name": "Very large file: futureagi/tracer/utils/otel.py (1812 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/utils/otel.py (1812 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c3c43770da3e482", "name": "Very large file: futureagi/tracer/utils/filters.py (2528 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/utils/filters.py (2528 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c9f0f8f89565a5d", "name": "Very large file: futureagi/tracer/utils/observability_provider.py (1439 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/utils/observability_provider.py (1439 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d69e301532240a05", "name": "Very large file: futureagi/tracer/serializers/filters.py (1451 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/serializers/filters.py (1451 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3f32f2775fa2c1b", "name": "Very large file: futureagi/tracer/services/users_list_manager.py (2132 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/users_list_manager.py (2132 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78bdceb3e472b736", "name": "Very large file: futureagi/tracer/services/dashboard_metrics_catalog.py (2230 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/dashboard_metrics_catalog.py (2230 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e266e39e45ad4e9", "name": "Very large file: futureagi/tracer/services/exact_aggregation_cache.py (1635 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/exact_aggregation_cache.py (1635 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-435f40e81685e119", "name": "Very large file: futureagi/tracer/services/observability_providers.py (1557 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/observability_providers.py (1557 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1fa9dc5030e184b1", "name": "Very large file: futureagi/tracer/services/clickhouse/graph_dispatch.py (2306 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/graph_dispatch.py (2306 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0cf568e9d292cc0", "name": "Very large file: futureagi/tracer/services/clickhouse/exact_graph_reads.py (4824 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/exact_graph_reads.py (4824 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08e07112b3b93091", "name": "Very large file: futureagi/tracer/services/clickhouse/bounded_graph_reads.py (1546 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/bounded_graph_reads.py (1546 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97fc3d873f7a4fcd", "name": "Very large file: futureagi/tracer/services/clickhouse/schema.py (2317 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/schema.py (2317 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22ea8102b3c1e88a", "name": "Very large file: futureagi/tracer/services/clickhouse/attribute_cursor_state.py (1584 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/attribute_cursor_state.py (1584 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-966b4519fe66346f", "name": "Very large file: futureagi/tracer/services/clickhouse/attribute_reads.py (6623 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/attribute_reads.py (6623 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27a946d47e954a34", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/span_reader.py (3104 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/span_reader.py (3104 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f8acb209059153c", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/attribute_catalog_backfill.py (2219 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/attribute_catalog_backfill.py (2219 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f48e1b3aa2d2071", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/attribute_catalog_reader.py (1849 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/attribute_catalog_reader.py (1849 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bddde6ccdef832b", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/query_builders/trace_list.py (1345 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/query_builders/trace_list.py (1345 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0b5ed4ba92d1fac", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/dev_runtime.py (5009 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/dev_runtime.py (5009 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b51a5f392f697508", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/durable_lifecycle.py (2679 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/durable_lifecycle.py (2679 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb6c23ef89148ea3", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/coordinator.py (1765 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/coordinator.py (1765 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bea7ed2f79c97e4", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/state_store.py (1667 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/state_store.py (1667 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d455ef9b782aac24", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/span_source.py (2342 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/span_source.py (2342 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-287b7c7334278a15", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/reader.py (1843 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/reader.py (1843 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1fa58022400d64b", "name": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/source_adapters.py (2323 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/source_adapters.py (2323 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87284e639c7e7165", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/span_list.py (2609 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/span_list.py (2609 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15738d90bbc74fbe", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/voice_call_list.py (1360 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/voice_call_list.py (1360 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-359b013068d6cd29", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/user_list.py (2327 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/user_list.py (2327 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-321caf2ea7b3e30a", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/dashboard.py (3890 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/dashboard.py (3890 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb31149a8e09f5a0", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/session_list.py (3471 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/session_list.py (3471 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce3f4aa1cea0061b", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/filters.py (3000 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/filters.py (3000 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb27d6d81811bcc9", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/latest_filter_predicates.py (2047 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/latest_filter_predicates.py (2047 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75d724b09d2d2afb", "name": "Very large file: futureagi/tracer/services/clickhouse/query_builders/trace_list.py (5962 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/trace_list.py (5962 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-165c1f628414502e", "name": "Very large file: futureagi/tracer/queries/feed.py (3400 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/queries/feed.py (3400 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20be2b7eb7a139d9", "name": "Very large file: futureagi/tracer/queries/error_analysis.py (1487 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/queries/error_analysis.py (1487 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae6e0c79bd5be749", "name": "Very large file: futureagi/tracer/selectors/trace_filter_reads.py (3814 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/selectors/trace_filter_reads.py (3814 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a35f3d634f4c9d6", "name": "Very large file: futureagi/tracer/selectors/eval_tasks/row_resolver.py (1716 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/selectors/eval_tasks/row_resolver.py (1716 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a99795e707c3033", "name": "Very large file: futureagi/tracer/views/dashboard.py (7330 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/dashboard.py (7330 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55345d5024c202bd", "name": "Very large file: futureagi/tracer/views/span_attributes.py (1193 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/span_attributes.py (1193 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b311c0433d24240", "name": "Very large file: futureagi/tracer/views/observation_span.py (5303 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/observation_span.py (5303 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00748795188208da", "name": "Very large file: futureagi/tracer/views/eval_task.py (3274 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/eval_task.py (3274 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e4662579a625eec", "name": "Very large file: futureagi/tracer/views/annotation.py (1364 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/annotation.py (1364 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d356ce7eb0a09e8", "name": "Very large file: futureagi/tracer/views/project.py (1426 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/project.py (1426 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58573e635d4194db", "name": "Very large file: futureagi/tracer/views/project_version.py (2074 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/project_version.py (2074 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32a329b77f40386e", "name": "Very large file: futureagi/tracer/views/trace.py (7242 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/trace.py (7242 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-688c0a4bae038561", "name": "Very large file: futureagi/tracer/views/trace_session.py (4096 lines)", "shortDescription": {"text": "Very large file: futureagi/tracer/views/trace_session.py (4096 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a43490a1f0961ec", "name": "Very large file: futureagi/sdk/tests/test_analytics.py (1809 lines)", "shortDescription": {"text": "Very large file: futureagi/sdk/tests/test_analytics.py (1809 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28d177604e4455d3", "name": "Very large file: futureagi/ee/usage/utils/usage_entries.py (3019 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/usage/utils/usage_entries.py (3019 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9d6d9a01a19b470", "name": "Very large file: futureagi/ee/tests/test_deterministic_evaluator.py (1524 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/tests/test_deterministic_evaluator.py (1524 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8baa5c7c1788f7e6", "name": "Very large file: futureagi/ee/agenthub/fix_your_agent/fix_your_agent.py (1533 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/fix_your_agent/fix_your_agent.py (1533 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a8984304eb17f73", "name": "Very large file: futureagi/ee/agenthub/fix_your_agent/simulation_adapter.py (2473 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/fix_your_agent/simulation_adapter.py (2473 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ed48cbe68046e75", "name": "Very large file: futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py (2265 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py (2265 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f417497e360e8437", "name": "Very large file: futureagi/ee/agenthub/scenario_graph/old_graph_generator.py (1755 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/scenario_graph/old_graph_generator.py (1755 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84d2b884f5bf26b5", "name": "Very large file: futureagi/ee/agenthub/eval_orchestrator/orchestrator.py (1514 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/eval_orchestrator/orchestrator.py (1514 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36f240e48d3a2c80", "name": "Very large file: futureagi/ee/agenthub/eval_orchestrator/run_real_integration_tests.py (1047 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/eval_orchestrator/run_real_integration_tests.py (1047 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce7e7dc9e0f3db50", "name": "Very large file: futureagi/ee/agenthub/cluster_rca/agent.py (3025 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/cluster_rca/agent.py (3025 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-430500ee9071ae36", "name": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/prompts.py (1195 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/prompts.py (1195 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf3d7033bae6218f", "name": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py (4187 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py (4187 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3faa28162d77a310", "name": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent_old.py (1563 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent_old.py (1563 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1208616e2e966b6", "name": "Very large file: futureagi/ee/agenthub/prompt_generate_agent/prompt_generate.py (1823 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/agenthub/prompt_generate_agent/prompt_generate.py (1823 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95fd6a857344b9ed", "name": "Very large file: futureagi/ee/voice/tests/test_phone_number_dispatcher.py (1272 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/voice/tests/test_phone_number_dispatcher.py (1272 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4534687de722ed2b", "name": "Very large file: futureagi/ee/voice/constants/voice_mapper.py (2888 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/voice/constants/voice_mapper.py (2888 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a922bfaefbc911d8", "name": "Very large file: futureagi/ee/voice/temporal/workflows/call_execution_workflow.py (1651 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/voice/temporal/workflows/call_execution_workflow.py (1651 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4aa031b72595e88e", "name": "Very large file: futureagi/ee/voice/services/vapi_service.py (2841 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/voice/services/vapi_service.py (2841 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16382b2e7841b805", "name": "Very large file: futureagi/ee/evals/llm/agent_evaluator/evaluator.py (2887 lines)", "shortDescription": {"text": "Very large file: futureagi/ee/evals/llm/agent_evaluator/evaluator.py (2887 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-255987f3233320bd", "name": "Very large file: scripts/qa/replay_observe_queries_readonly.py (1529 lines)", "shortDescription": {"text": "Very large file: scripts/qa/replay_observe_queries_readonly.py (1529 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59d9de5a46bbb2c2", "name": "Very large file: scripts/qa/test_observe_span_reference.py (1979 lines)", "shortDescription": {"text": "Very large file: scripts/qa/test_observe_span_reference.py (1979 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e095c9385b50218", "name": "Very large file: scripts/qa/test_replay_observe_queries_readonly.py (1141 lines)", "shortDescription": {"text": "Very large file: scripts/qa/test_replay_observe_queries_readonly.py (1141 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a08346faef6a116", "name": "Very large file: scripts/qa/test_observe_trace_id_reference.py (1576 lines)", "shortDescription": {"text": "Very large file: scripts/qa/test_observe_trace_id_reference.py (1576 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c39fd040f4a2427c", "name": "Very large file: scripts/qa/replay_observe_filters.py (1373 lines)", "shortDescription": {"text": "Very large file: scripts/qa/replay_observe_filters.py (1373 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a0812f025023861", "name": "Very large file: deploy/dev/property-catalog/render.py (1633 lines)", "shortDescription": {"text": "Very large file: deploy/dev/property-catalog/render.py (1633 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3feabcf644e0a9cf", "name": "Very large file: deploy/dev/property-catalog-docker/render.py (1342 lines)", "shortDescription": {"text": "Very large file: deploy/dev/property-catalog-docker/render.py (1342 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b469c772b8c62615", "name": "Very large file: agentcc-gateway/internal/routing/routing_test.go (3404 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/routing/routing_test.go (3404 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eea0788593c1248b", "name": "Very large file: agentcc-gateway/internal/config/config.go (1349 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/config/config.go (1349 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89ef635123d94d73", "name": "Very large file: agentcc-gateway/internal/mcp/server_test.go (1710 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/mcp/server_test.go (1710 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb2ef7946e8a75ab", "name": "Very large file: agentcc-gateway/internal/providers/bedrock/translate_test.go (1951 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/providers/bedrock/translate_test.go (1951 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9b617dd3209c52f", "name": "Very large file: agentcc-gateway/internal/providers/gemini/translate_test.go (2064 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/providers/gemini/translate_test.go (2064 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3cb6f19cad33d4a", "name": "Very large file: agentcc-gateway/internal/providers/anthropic/translate_test.go (1929 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/providers/anthropic/translate_test.go (1929 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2391d05a595d0753", "name": "Very large file: agentcc-gateway/internal/server/handlers.go (2291 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/server/handlers.go (2291 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-effec56ad912c4bd", "name": "Very large file: agentcc-gateway/internal/server/server_test.go (2287 lines)", "shortDescription": {"text": "Very large file: agentcc-gateway/internal/server/server_test.go (2287 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-777a13c1a0a37351", "name": "64 TODO/FIXME markers", "shortDescription": {"text": "64 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 829 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 2182 placeholder/mock markers across 712 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc5e54ab3a72535e", "name": "Legacy-named symbol `cs_api_journey_legacy` in frontend/scripts/api-journeys/journeys/app-core.mjs:7102", "shortDescription": {"text": "Legacy-named symbol `cs_api_journey_legacy` in frontend/scripts/api-journeys/journeys/app-core.mjs:7102"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa7cfd04a11cc70a", "name": "Legacy-named symbol `allow_copy` in frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs:10836", "shortDescription": {"text": "Legacy-named symbol `allow_copy` in frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs:10836"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-656d3509e4f0f80f", "name": "Legacy-named symbol `model_deprecated` in frontend/src/generated/api-contracts/api.schemas.ts:7960", "shortDescription": {"text": "Legacy-named symbol `model_deprecated` in frontend/src/generated/api-contracts/api.schemas.ts:7960"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d46c4996c028d8c5", "name": "Commented-code block (10 lines) in frontend/src/utils/utils.js:211", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/utils/utils.js:211"}, "fullDescription": {"text": "6 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-8128d7eff56baf54", "name": "Commented-code block (7 lines) in frontend/src/utils/Mixpanel/EventNames.js:319", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/utils/Mixpanel/EventNames.js:319"}, "fullDescription": {"text": "4 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-81439b9f669e1a68", "name": "Commented-code block (7 lines) in frontend/src/components/VariableDrawer/VariableDrawer.jsx:289", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/components/VariableDrawer/VariableDrawer.jsx:289"}, "fullDescription": {"text": "6 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-2d92a5516aeac6f2", "name": "Commented-code block (5 lines) in frontend/src/components/DateRangePicker/DateRangerPicker.stories.jsx:12", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/DateRangePicker/DateRangerPicker.stories.jsx:12"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-2d13afea0e4d27ce", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/EndCallNode.jsx:117", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/EndCallNode.jsx:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c59ff35bbd68dfec", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/TransferChatNode.jsx:118", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/TransferChatNode.jsx:118"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cabfb0a63d5a0f8", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/TransferCallNode.jsx:118", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/TransferCallNode.jsx:118"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f12e808943d9a474", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/EndChatNode.jsx:117", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/EndChatNode.jsx:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17249b88c9e67454", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/ConversationNode.jsx:167", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/ConversationNode.jsx:167"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbc58474d81d2c34", "name": "Commented-code block (5 lines) in frontend/src/components/prompt-section/PromptSection.jsx:245", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/prompt-section/PromptSection.jsx:245"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a81bf284a6192adf", "name": "Commented-code block (6 lines) in frontend/src/components/websocket/use-socket.jsx:247", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/components/websocket/use-socket.jsx:247"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-3784de19afd11ec4", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/custom-model-options/CreateResponseSchema.jsx:285", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/custom-model-options/CreateResponseSchema.jsx:285"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10ee823d54414d7c", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/ImprovePromptDrawer/ImporvedPromptHeader.jsx:96", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/ImprovePromptDrawer/ImporvedPromptHeader.jsx:96"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1437208a0867a4b3", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/PromptCards/common.js:645", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/PromptCards/common.js:645"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8dc818d5ae1b6a2", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/components/custom-audio/audioHelper.js:59", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/components/custom-audio/audioHelper.js:59"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-71c22f99d28494c3", "name": "Commented-code block (5 lines) in frontend/src/components/traceDetailDrawer/BottomAnnotationTab/bottom-annotations-tab.j", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/traceDetailDrawer/BottomAnnotationTab/bottom-annotations-tab.jsx:62"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ec9f17f96b58097c", "name": "Commented-code block (8 lines) in frontend/src/components/traceDetailDrawer/CustomRenderer/EvalsCustomCellRenderer.jsx:1", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/components/traceDetailDrawer/CustomRenderer/EvalsCustomCellRenderer.jsx:191"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-bdde56143b5992bd", "name": "Commented-code block (8 lines) in frontend/src/components/logo/logo.jsx:18", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/components/logo/logo.jsx:18"}, "fullDescription": {"text": "5 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-38fd2be625de0b7d", "name": "Legacy-named symbol `ic_copy` in frontend/src/components/custom-model-tools/EditTool.jsx:241", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/custom-model-tools/EditTool.jsx:241"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5d7ca3dc82a2c30", "name": "Commented-code block (8 lines) in frontend/src/components/custom-model-dropdown/ModelButtonField.jsx:52", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/components/custom-model-dropdown/ModelButtonField.jsx:52"}, "fullDescription": {"text": "5 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1d3912d4ec3d759b", "name": "Commented-code block (11 lines) in frontend/src/components/custom-model-dropdown/CloudProviderModals.jsx:58", "shortDescription": {"text": "Commented-code block (11 lines) in frontend/src/components/custom-model-dropdown/CloudProviderModals.jsx:58"}, "fullDescription": {"text": "9 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-c2297f3a797fb19b", "name": "Commented-code block (6 lines) in frontend/src/components/ConfigureApiKeysModal/ConfigureKeysContent.jsx:34", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/components/ConfigureApiKeysModal/ConfigureKeysContent.jsx:34"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a85247ee4ca1d9db", "name": "Commented-code block (13 lines) in frontend/src/routes/sections/dashboard.jsx:446", "shortDescription": {"text": "Commented-code block (13 lines) in frontend/src/routes/sections/dashboard.jsx:446"}, "fullDescription": {"text": "9 of 13 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-54cd36127a8a1919", "name": "Commented-code block (10 lines) in frontend/src/pages/dashboard/settings/InvoiceHistoryTable.jsx:22", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/pages/dashboard/settings/InvoiceHistoryTable.jsx:22"}, "fullDescription": {"text": "7 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-838ebd03dc7c00c8", "name": "Commented-code block (6 lines) in frontend/src/pages/dashboard/settings/IconComponents.jsx:60", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/pages/dashboard/settings/IconComponents.jsx:60"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-f2207eb74cee4ac7", "name": "Commented-code block (5 lines) in frontend/src/pages/dashboard/settings/InvitationsTable.jsx:212", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/pages/dashboard/settings/InvitationsTable.jsx:212"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-16817e295c991a82", "name": "Legacy-named symbol `ic_copy` in frontend/src/pages/dashboard/settings/api-keys/CreateApiKey.jsx:157", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/pages/dashboard/settings/api-keys/CreateApiKey.jsx:157"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dd56fe4c97172ba", "name": "Commented-code block (10 lines) in frontend/src/pages/dashboard/settings/UserManagementV2/WorkSpaceManagement.jsx:239", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/pages/dashboard/settings/UserManagementV2/WorkSpaceManagement.jsx:239"}, "fullDescription": {"text": "9 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a34e0a7cad3a7c68", "name": "Commented-code block (6 lines) in frontend/src/pages/dashboard/models/Performance/PerformanceTable.jsx:74", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/pages/dashboard/models/Performance/PerformanceTable.jsx:74"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ce6b011af54e2cf5", "name": "Commented-code block (13 lines) in frontend/src/sections/prompt/NewPrompt/TopMenuOptions/ImportDataset.jsx:144", "shortDescription": {"text": "Commented-code block (13 lines) in frontend/src/sections/prompt/NewPrompt/TopMenuOptions/ImportDataset.jsx:144"}, "fullDescription": {"text": "10 of 13 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-358e833d2b43a33c", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/test-detail/FixMyAgentDrawer/OptimizationDetail/PrompDetails/Prom", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/test-detail/FixMyAgentDrawer/OptimizationDetail/PrompDetails/PromptPanelHeader.jsx:38"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15577ecf9374d17a", "name": "Commented-code block (5 lines) in frontend/src/sections/test-detail/CellRenderers/CallDetailCellRenderer.jsx:17", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/test-detail/CellRenderers/CallDetailCellRenderer.jsx:17"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a3330dfc8803cf64", "name": "Commented-code block (18 lines) in frontend/src/sections/sync/Connectors/ConnectorView.jsx:19", "shortDescription": {"text": "Commented-code block (18 lines) in frontend/src/sections/sync/Connectors/ConnectorView.jsx:19"}, "fullDescription": {"text": "13 of 18 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-9504800c8a23f958", "name": "Commented-code block (7 lines) in frontend/src/sections/develop/AddRowDrawer/CreateSyntheticDataView.jsx:192", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/sections/develop/AddRowDrawer/CreateSyntheticDataView.jsx:192"}, "fullDescription": {"text": "4 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-02fd43fdc70ea32b", "name": "Commented-code block (6 lines) in frontend/src/sections/experiment-detail/IndividualDevelopExperimentSelect.jsx:28", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/experiment-detail/IndividualDevelopExperimentSelect.jsx:28"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-914f6493eb88ba49", "name": "Commented-code block (6 lines) in frontend/src/sections/experiment-detail/ExperimentSummary/CustomRenderers/ExperimentHe", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/experiment-detail/ExperimentSummary/CustomRenderers/ExperimentHeader.jsx:53"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-60a57baccd4d7a0b", "name": "Commented-code block (9 lines) in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawer.jsx:21", "shortDescription": {"text": "Commented-code block (9 lines) in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawer.jsx:21"}, "fullDescription": {"text": "5 of 9 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-dee01dd7e7c05e7d", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawerContent.js", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawerContent.jsx:626"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95b97f084968ab8e", "name": "Commented-code block (7 lines) in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDataView.jsx:670", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDataView.jsx:670"}, "fullDescription": {"text": "6 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-54437a1703a40bba", "name": "Commented-code block (18 lines) in frontend/src/sections/experiment-detail/ExperimentData/IndividualExperimentDataView.j", "shortDescription": {"text": "Commented-code block (18 lines) in frontend/src/sections/experiment-detail/ExperimentData/IndividualExperimentDataView.jsx:129"}, "fullDescription": {"text": "12 of 18 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a1d3e8ee606943ec", "name": "Commented-code block (10 lines) in frontend/src/sections/HeaderComponent/HeaderComponent.jsx:41", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/sections/HeaderComponent/HeaderComponent.jsx:41"}, "fullDescription": {"text": "6 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-040f3d0b5007905a", "name": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/projects/legacyPresetInference.js:63", "shortDescription": {"text": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/projects/legacyPresetInference.js:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3006db1c92993c8e", "name": "Commented-code block (11 lines) in frontend/src/sections/projects/ConfigNavData.jsx:96", "shortDescription": {"text": "Commented-code block (11 lines) in frontend/src/sections/projects/ConfigNavData.jsx:96"}, "fullDescription": {"text": "6 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-7bdf0689393cf5b9", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/TracesDrawer/Header.jsx:59", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/TracesDrawer/Header.jsx:59"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f6ccf1e4a0e79ea", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/MonitorsView/MonitorsView.jsx:405", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/MonitorsView/MonitorsView.jsx:405"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e2cd9f3caa1c954", "name": "Commented-code block (6 lines) in frontend/src/sections/projects/UsersView/UserDetails/UserTraceSessionSection.jsx:116", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/projects/UsersView/UserDetails/UserTraceSessionSection.jsx:116"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-9156325028dcfec4", "name": "Commented-code block (5 lines) in frontend/src/sections/projects/ChartsView/ChartsView.jsx:190", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/projects/ChartsView/ChartsView.jsx:190"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-be71a1265d59a021", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/SessionsView/ConversationCard.jsx:165", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/SessionsView/ConversationCard.jsx:165"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25e872e62a318d0d", "name": "Commented-code block (6 lines) in frontend/src/sections/projects/SessionsView/ReplaySessions/configurations.js:96", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/projects/SessionsView/ReplaySessions/configurations.js:96"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-6f8dc85e38c03d2f", "name": "Commented-code block (6 lines) in frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx:1036", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx:1036"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1469388c16501c49", "name": "Commented-code block (7 lines) in frontend/src/sections/projects/LLMTracing/SpanGrid.jsx:970", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/sections/projects/LLMTracing/SpanGrid.jsx:970"}, "fullDescription": {"text": "5 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-7a2d1d60d2fee525", "name": "Commented-code block (5 lines) in frontend/src/sections/common/DevelopeSearch.jsx:40", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/DevelopeSearch.jsx:40"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-9ee64c960341ad1e", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/common/DatapointCard.jsx:202", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/common/DatapointCard.jsx:202"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-675d4c0c3617e8f1", "name": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx:264", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx:264"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-21218947ebf39de8", "name": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/CreateEvaluationGroupDrawer.jsx:327", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/CreateEvaluationGroupDrawer.jsx:327"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-67006b321418cf1f", "name": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/EvaluationMappingForm.jsx:743", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/EvaluationMappingForm.jsx:743"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ad1c82234e821a64", "name": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/context/EvaluationProvider.jsx:35", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/context/EvaluationProvider.jsx:35"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-b972b9f1238907f0", "name": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/common/EvalsTasks/common.js:3", "shortDescription": {"text": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/common/EvalsTasks/common.js:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-103768190fa1b886", "name": "Commented-code block (9 lines) in frontend/src/sections/develop-detail/Common/EvaluationConfigure/validation.js:118", "shortDescription": {"text": "Commented-code block (9 lines) in frontend/src/sections/develop-detail/Common/EvaluationConfigure/validation.js:118"}, "fullDescription": {"text": "5 of 9 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-381a34dea575b724", "name": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/Common/CustomModelSelection/CustomModelSelection.", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/Common/CustomModelSelection/CustomModelSelection.jsx:74"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-8da0c6e85c5d325e", "name": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/DevelopBarRightSection/CompareDataRightSection.js", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/DevelopBarRightSection/CompareDataRightSection.jsx:310"}, "fullDescription": {"text": "6 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-02996f83ab2906bb", "name": "Commented-code block (17 lines) in frontend/src/sections/develop-detail/AddColumn/AddColumnDrawer.jsx:84", "shortDescription": {"text": "Commented-code block (17 lines) in frontend/src/sections/develop-detail/AddColumn/AddColumnDrawer.jsx:84"}, "fullDescription": {"text": "9 of 17 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-c2c3b4bb570d8a84", "name": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/AddColumn/ConditionalNode/validation.js:79", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/AddColumn/ConditionalNode/validation.js:79"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-19b3806223b29adb", "name": "Commented-code block (10 lines) in frontend/src/sections/develop-detail/AddColumn/Retrieval/validation.js:3", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/sections/develop-detail/AddColumn/Retrieval/validation.js:3"}, "fullDescription": {"text": "5 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-b17d54989a47ca4f", "name": "Commented-code block (7 lines) in frontend/src/sections/develop-detail/DataTab/DevelopData.jsx:955", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/sections/develop-detail/DataTab/DevelopData.jsx:955"}, "fullDescription": {"text": "5 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-7c207974f2be6b97", "name": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/DataTab/common.js:715", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/DataTab/common.js:715"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ec4a3ca30472ab2b", "name": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/DataTab/DevelopDataV2.jsx:390", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/DataTab/DevelopDataV2.jsx:390"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-c1284a50cc862a6a", "name": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/DatasetOptimizationCan", "shortDescription": {"text": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/DatasetOptimizationCancelled.jsx:83"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a69847cc59ee10b", "name": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/DatasetOptimizationHea", "shortDescription": {"text": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/DatasetOptimizationHeaderComponent.jsx:132"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-004cd04e1381e115", "name": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/common.js:80", "shortDescription": {"text": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/common.js:80"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-056f712d56c45f32", "name": "Legacy-named symbol `ic_stop_v2` in frontend/src/sections/develop-detail/DatasetOptimization/CellRenderers/StatusCellRen", "shortDescription": {"text": "Legacy-named symbol `ic_stop_v2` in frontend/src/sections/develop-detail/DatasetOptimization/CellRenderers/StatusCellRenderer.jsx:137"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84d88068a2c9da72", "name": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/DatasetSummaryTab/ChartsContainer/HeatChart.jsx:6", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/DatasetSummaryTab/ChartsContainer/HeatChart.jsx:67"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1598cbc0be327746", "name": "Commented-code block (6 lines) in frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx:330", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx:330"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-5ab28314bae67c42", "name": "Commented-code block (6 lines) in frontend/src/sections/workbench/createPrompt/promptActions/PromptActions.jsx:322", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/workbench/createPrompt/promptActions/PromptActions.jsx:322"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-22be1e91be105a55", "name": "Commented-code block (5 lines) in frontend/src/sections/workbench/createPrompt/Playground/OutputSection/SingleResult.jsx", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/workbench/createPrompt/Playground/OutputSection/SingleResult.jsx:96"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-b47b5faeae7d3603", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/Playground/OutputSection/CopyButton.jsx:22", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/Playground/OutputSection/CopyButton.jsx:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b79597165a13e78", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/Metrics/MetricEmptyState.jsx:74", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/Metrics/MetricEmptyState.jsx:74"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0acae331b8d2c249", "name": "Commented-code block (11 lines) in frontend/src/sections/workbench/createPrompt/Evaluation/EvaluationData/EvaluationData", "shortDescription": {"text": "Commented-code block (11 lines) in frontend/src/sections/workbench/createPrompt/Evaluation/EvaluationData/EvaluationData.jsx:338"}, "fullDescription": {"text": "6 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-bfb2cdf4846bb75d", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/VersionHistory/LabelDropdown/PromptLabel.j", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/VersionHistory/LabelDropdown/PromptLabel.jsx:139"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f9cb21384e7fb1e", "name": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/tasks/TaskCreatePage.jsx:8", "shortDescription": {"text": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/tasks/TaskCreatePage.jsx:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9cf620c9c3e1b0c0", "name": "Legacy-named symbol `convertNewToOld` in frontend/src/sections/tasks/components/TaskFilterBar.jsx:123", "shortDescription": {"text": "Legacy-named symbol `convertNewToOld` in frontend/src/sections/tasks/components/TaskFilterBar.jsx:123"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfc6854f935734aa", "name": "Legacy-named symbol `ic_annotation_v2` in frontend/src/sections/annotations/queues/items/queue-items-empty.jsx:28", "shortDescription": {"text": "Legacy-named symbol `ic_annotation_v2` in frontend/src/sections/annotations/queues/items/queue-items-empty.jsx:28"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963f4e1387d11643", "name": "Legacy-named symbol `fetchNextSimulationEvalPageLegacy` in frontend/src/sections/annotations/queues/view/create-rule-dia", "shortDescription": {"text": "Legacy-named symbol `fetchNextSimulationEvalPageLegacy` in frontend/src/sections/annotations/queues/view/create-rule-dialog.jsx:654"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-948568e327bfdaf0", "name": "Legacy-named symbol `_buildBlocksFromLegacy` in frontend/src/sections/falcon-ai/store/useFalconStore.js:10", "shortDescription": {"text": "Legacy-named symbol `_buildBlocksFromLegacy` in frontend/src/sections/falcon-ai/store/useFalconStore.js:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ce2de6e9c21f7b3", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/keys/view/CreateApiKey.jsx:158", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/keys/view/CreateApiKey.jsx:158"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fb9a2fcba0b84a3", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/keys/view/SecretKeyRenderer.jsx:46", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/keys/view/SecretKeyRenderer.jsx:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5de344ab91b6df0a", "name": "Commented-code block (7 lines) in frontend/src/sections/agents/helper.jsx:254", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/src/sections/agents/helper.jsx:254"}, "fullDescription": {"text": "4 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-fd62e074b9c7f4f8", "name": "Commented-code block (6 lines) in frontend/src/sections/user/view/user-list-view.jsx:235", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/user/view/user-list-view.jsx:235"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-f19cb65327b9cae5", "name": "Commented-code block (8 lines) in frontend/src/sections/evals/EvalsUsageView.jsx:338", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/sections/evals/EvalsUsageView.jsx:338"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-00e001ed6e960d7e", "name": "Commented-code block (11 lines) in frontend/src/sections/evals/EvalDetails/EvalsLog/CellRenderingData.jsx:594", "shortDescription": {"text": "Commented-code block (11 lines) in frontend/src/sections/evals/EvalDetails/EvalsLog/CellRenderingData.jsx:594"}, "fullDescription": {"text": "7 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-812f0a77563010af", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/evals/EvalDetails/EvalsLog/LogsDrawer.jsx:162", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/evals/EvalDetails/EvalsLog/LogsDrawer.jsx:162"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c7ffe2410ea4bce", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/evals/EvalPlayground/BottomEvaluationSection/BottomEvaluationSect", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/evals/EvalPlayground/BottomEvaluationSection/BottomEvaluationSection.jsx:164"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-327754bb962d4d99", "name": "Commented-code block (5 lines) in frontend/src/sections/model/datasets/Datasets.jsx:166", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/model/datasets/Datasets.jsx:166"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-6573e307c713c6b1", "name": "Commented-code block (12 lines) in frontend/src/sections/model/journey/label-studio-component.jsx:25", "shortDescription": {"text": "Commented-code block (12 lines) in frontend/src/sections/model/journey/label-studio-component.jsx:25"}, "fullDescription": {"text": "6 of 12 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-3997645dececcdf1", "name": "Commented-code block (6 lines) in frontend/src/sections/model/annotate/annotation-task-table.jsx:74", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/model/annotate/annotation-task-table.jsx:74"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-50f3b2eaeae7e8ac", "name": "Commented-code block (8 lines) in frontend/src/sections/model/dataset-detail/DatasetDetailSort.jsx:63", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/sections/model/dataset-detail/DatasetDetailSort.jsx:63"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-79337513421ab471", "name": "Commented-code block (5 lines) in frontend/src/sections/model/dataset-detail/DatasetDetail/DatasetDetail.jsx:76", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/model/dataset-detail/DatasetDetail/DatasetDetail.jsx:76"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-c8d8ff7c3feca13c", "name": "Commented-code block (5 lines) in frontend/src/sections/model/optimize-detail/OptimizeDetailView.jsx:34", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/sections/model/optimize-detail/OptimizeDetailView.jsx:34"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-4113226c38b2ee75", "name": "Commented-code block (10 lines) in frontend/src/sections/model/optimize/OptimizeDrawer.jsx:81", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/sections/model/optimize/OptimizeDrawer.jsx:81"}, "fullDescription": {"text": "7 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-f2dd075e38554964", "name": "Commented-code block (6 lines) in frontend/src/sections/model/optimize/OptimizeList.jsx:164", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/model/optimize/OptimizeList.jsx:164"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-e15d0a6f29ce2f27", "name": "Commented-code block (6 lines) in frontend/src/sections/scenarios/scenario-detail/ScenarioDatasetView.jsx:272", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/scenarios/scenario-detail/ScenarioDatasetView.jsx:272"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-53e5f3af572c51b2", "name": "Commented-code block (6 lines) in frontend/src/sections/agent-playground/AgentPlaygroundView.jsx:44", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/agent-playground/AgentPlaygroundView.jsx:44"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-0691fd835d3fc200", "name": "Commented-code block (6 lines) in frontend/src/sections/agent-playground/components/FirstTimeExperience.jsx:29", "shortDescription": {"text": "Commented-code block (6 lines) in frontend/src/sections/agent-playground/components/FirstTimeExperience.jsx:29"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-48ac95af9dec7b07", "name": "Legacy-named symbol `ic_copy` in frontend/src/sections/agent-playground/components/ConnectedNodesPanel.jsx:80", "shortDescription": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/agent-playground/components/ConnectedNodesPanel.jsx:80"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-489c37ffd180728f", "name": "Commented-code block (10 lines) in frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariab", "shortDescription": {"text": "Commented-code block (10 lines) in frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariableDrawer.jsx:210"}, "fullDescription": {"text": "5 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-92fcf6ef70bbf709", "name": "Commented-code block (5 lines) in frontend/src/hooks/use-debounced-filter-update.js:28", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/hooks/use-debounced-filter-update.js:28"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-cee0bbc1a2318afb", "name": "Commented-code block (8 lines) in frontend/src/layouts/dashboard/ProfilePopover.jsx:33", "shortDescription": {"text": "Commented-code block (8 lines) in frontend/src/layouts/dashboard/ProfilePopover.jsx:33"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-bd09d0ae2e0aff77", "name": "Commented-code block (5 lines) in frontend/src/layouts/dashboard/config-navigation.jsx:98", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/layouts/dashboard/config-navigation.jsx:98"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-57a582f5e6c9a4d6", "name": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/integrations/temporal/activities.py:671", "shortDescription": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/integrations/temporal/activities.py:671"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `log.started_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d46624c88232354", "name": "Legacy-named symbol `pubsub_v1` in futureagi/integrations/services/queue_service.py:104", "shortDescription": {"text": "Legacy-named symbol `pubsub_v1` in futureagi/integrations/services/queue_service.py:104"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61fbefbdb0295a67", "name": "Legacy-named symbol `experiment_feedback_v2` in futureagi/model_hub/urls.py:98", "shortDescription": {"text": "Legacy-named symbol `experiment_feedback_v2` in futureagi/model_hub/urls.py:98"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a245fc68b350a5d", "name": "Commented-code block (5 lines) in futureagi/model_hub/urls.py:497", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/model_hub/urls.py:497"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-e1b2713dcd6fc8c4", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/model_hub/constants.py:308", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/model_hub/constants.py:308"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-189cf030e4b3571f", "name": "Legacy-named symbol `level_or_legacy` in futureagi/model_hub/models/annotation_queues.py:323", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/model_hub/models/annotation_queues.py:323"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0842bc44a20ffd38", "name": "Commented-code block (8 lines) in futureagi/model_hub/models/develop_optimisation.py:132", "shortDescription": {"text": "Commented-code block (8 lines) in futureagi/model_hub/models/develop_optimisation.py:132"}, "fullDescription": {"text": "7 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-0358f05155273dcf", "name": "Commented-code block (6 lines) in futureagi/model_hub/models/choices.py:1355", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/model_hub/models/choices.py:1355"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a27478f46fe7e78b", "name": "Legacy-named symbol `allow_copy` in futureagi/model_hub/models/evals_metric.py:158", "shortDescription": {"text": "Legacy-named symbol `allow_copy` in futureagi/model_hub/models/evals_metric.py:158"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b8205a87136a736", "name": "Likely N+1 query: `for feedback_cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/utils/auto_annotate.py:146", "shortDescription": {"text": "Likely N+1 query: `for feedback_cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/utils/auto_annotate.py:146"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `feedback_cell.feedback_info.get` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd6e0ad2c18aafaa", "name": "Commented-code block (11 lines) in futureagi/model_hub/utils/performance_ch.py:289", "shortDescription": {"text": "Commented-code block (11 lines) in futureagi/model_hub/utils/performance_ch.py:289"}, "fullDescription": {"text": "11 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-868d772279d4ce19", "name": "Legacy-named symbol `is_v1` in futureagi/model_hub/utils/azure_endpoints.py:85", "shortDescription": {"text": "Legacy-named symbol `is_v1` in futureagi/model_hub/utils/azure_endpoints.py:85"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2dc18dbbb3b8fa57", "name": "Legacy-named symbol `scribe_v1` in futureagi/model_hub/utils/utils.py:997", "shortDescription": {"text": "Legacy-named symbol `scribe_v1` in futureagi/model_hub/utils/utils.py:997"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a085223a8f27063e", "name": "Likely N+1 query: `for evaluator in \u2026` triggers a query per row \u2014 futureagi/model_hub/utils/eval_list.py:254", "shortDescription": {"text": "Likely N+1 query: `for evaluator in \u2026` triggers a query per row \u2014 futureagi/model_hub/utils/eval_list.py:254"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `evaluator.user.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8cd0fc39140c8d9", "name": "Likely N+1 query: `for task in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/experiment_runner.py:208", "shortDescription": {"text": "Likely N+1 query: `for task in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/experiment_runner.py:208"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `task.experiment.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-467eebfc2c2c889c", "name": "Likely N+1 query: `for pending_task in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/experiment_runner.py:286", "shortDescription": {"text": "Likely N+1 query: `for pending_task in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/experiment_runner.py:286"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `pending_task.row.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-619ed2444787585d", "name": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/tasks/prompt_template_optimizer.py:14", "shortDescription": {"text": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/tasks/prompt_template_optimizer.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b105b48be574ad1", "name": "Likely N+1 query: `for optimization_obj in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optim", "shortDescription": {"text": "Likely N+1 query: `for optimization_obj in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:87"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `optimization_obj.metrics.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a87adb13bfb204e", "name": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:11", "shortDescription": {"text": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:116"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `metric.model.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bbaaae201365c85", "name": "Likely N+1 query: `for parent_node in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.", "shortDescription": {"text": "Likely N+1 query: `for parent_node in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:678"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `parent_node.child_nodes.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-570d089c24b7fbf7", "name": "Legacy-named symbol `tags_v2` in futureagi/model_hub/tasks/agent.py:15", "shortDescription": {"text": "Legacy-named symbol `tags_v2` in futureagi/model_hub/tasks/agent.py:15"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b80947e05f17aff", "name": "Commented-code block (5 lines) in futureagi/model_hub/tasks/agent.py:223", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/model_hub/tasks/agent.py:223"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1085fac381b05996", "name": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/agent.py:129", "shortDescription": {"text": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/agent.py:129"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `metric.model.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-985afb0e338cd27f", "name": "Commented-code block (5 lines) in futureagi/model_hub/tasks/user_evaluation.py:607", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/model_hub/tasks/user_evaluation.py:607"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-73b5b0724a64c0ac", "name": "Likely N+1 query: `for kb_file in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/develop_dataset.py:810", "shortDescription": {"text": "Likely N+1 query: `for kb_file in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/develop_dataset.py:810"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `kb_file.files.filter` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c913a5acc39aaf52", "name": "Legacy-named symbol `__plain_backup` in futureagi/model_hub/management/commands/convert_vector_table_to_replicated.py:8", "shortDescription": {"text": "Legacy-named symbol `__plain_backup` in futureagi/model_hub/management/commands/convert_vector_table_to_replicated.py:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da12fb99630372ba", "name": "Likely N+1 query: `for ta in \u2026` triggers a query per row \u2014 futureagi/model_hub/management/commands/backfill_scores.py:14", "shortDescription": {"text": "Likely N+1 query: `for ta in \u2026` triggers a query per row \u2014 futureagi/model_hub/management/commands/backfill_scores.py:146"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ta.user.organization` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7e6dc7bfe3bcee7", "name": "Likely N+1 query: `for ia in \u2026` triggers a query per row \u2014 futureagi/model_hub/management/commands/backfill_scores.py:23", "shortDescription": {"text": "Likely N+1 query: `for ia in \u2026` triggers a query per row \u2014 futureagi/model_hub/management/commands/backfill_scores.py:234"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ia.label.pk` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a0e8bce208164cd", "name": "Legacy-named symbol `allow_copy` in futureagi/model_hub/management/commands/seed_system_evals.py:198", "shortDescription": {"text": "Legacy-named symbol `allow_copy` in futureagi/model_hub/management/commands/seed_system_evals.py:198"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9c0b763b2cd96cb", "name": "Legacy-named symbol `model_deprecated` in futureagi/model_hub/serializers/dataset_optimization.py:317", "shortDescription": {"text": "Legacy-named symbol `model_deprecated` in futureagi/model_hub/serializers/dataset_optimization.py:317"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0ff0016f5a302c2", "name": "Commented-code block (5 lines) in futureagi/model_hub/serializers/run_prompt.py:274", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/model_hub/serializers/run_prompt.py:274"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-917a79793461b422", "name": "Commented-code block (6 lines) in futureagi/model_hub/serializers/develop_optimisation.py:97", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/model_hub/serializers/develop_optimisation.py:97"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ca2b00ae759cde15", "name": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/serializers/develop_annotations.py:315", "shortDescription": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/serializers/develop_annotations.py:315"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `cell.column.source_id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7d7d5350ab59aab", "name": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/model_hub/services/annotation_summary_service.py:150", "shortDescription": {"text": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/model_hub/services/annotation_summary_service.py:150"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `s.label.type` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df9592f3f79ca31e", "name": "Legacy-named symbol `tokenbf_v1` in futureagi/model_hub/services/legacy_ch_tables.py:156", "shortDescription": {"text": "Legacy-named symbol `tokenbf_v1` in futureagi/model_hub/services/legacy_ch_tables.py:156"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fa7e12a804cc0f0", "name": "Likely N+1 query: `for annot in \u2026` triggers a query per row \u2014 futureagi/model_hub/services/dataset_validators.py:175", "shortDescription": {"text": "Likely N+1 query: `for annot in \u2026` triggers a query per row \u2014 futureagi/model_hub/services/dataset_validators.py:175"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `annot.labels.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3d976c312d3a657", "name": "Likely N+1 query: `for ta in \u2026` triggers a query per row \u2014 futureagi/model_hub/migrations/0062_ttsvoice_score.py:95", "shortDescription": {"text": "Likely N+1 query: `for ta in \u2026` triggers a query per row \u2014 futureagi/model_hub/migrations/0062_ttsvoice_score.py:95"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ta.annotation_label.type` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-263157ead2ac4c4f", "name": "Legacy-named symbol `allow_copy` in futureagi/model_hub/migrations/0079_eval_permissions_fields.py:1", "shortDescription": {"text": "Legacy-named symbol `allow_copy` in futureagi/model_hub/migrations/0079_eval_permissions_fields.py:1"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4841564cddad1b80", "name": "Legacy-named symbol `is_v2` in futureagi/model_hub/views/experiments.py:955", "shortDescription": {"text": "Legacy-named symbol `is_v2` in futureagi/model_hub/views/experiments.py:955"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e75479bb2e476dee", "name": "Likely N+1 query: `for column in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiments.py:2079", "shortDescription": {"text": "Likely N+1 query: `for column in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiments.py:2079"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `column.cell_set.filter` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cce62c5234f5a577", "name": "Likely N+1 query: `for exp_dataset in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiments.py:2117", "shortDescription": {"text": "Likely N+1 query: `for exp_dataset in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiments.py:2117"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `exp_dataset.columns.filter` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e343e243dd515f58", "name": "Likely N+1 query: `for thread_comment in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/annotation_queues.py:87", "shortDescription": {"text": "Likely N+1 query: `for thread_comment in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/annotation_queues.py:878"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `thread_comment.mentioned_users.values_list` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf0cbf50795c6631", "name": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/views/optimize_dataset.py:20", "shortDescription": {"text": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/views/optimize_dataset.py:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-620a067f1ff0a3ec", "name": "Legacy-named symbol `config_copy` in futureagi/model_hub/views/eval_runner.py:2134", "shortDescription": {"text": "Legacy-named symbol `config_copy` in futureagi/model_hub/views/eval_runner.py:2134"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f564ecbd97d40c73", "name": "Likely N+1 query: `for user_eval_metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiment_runner.py:", "shortDescription": {"text": "Likely N+1 query: `for user_eval_metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiment_runner.py:825"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `user_eval_metric.template.template_type` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b5e64f753267ce4", "name": "Likely N+1 query: `for eval_template in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/eval_group.py:248", "shortDescription": {"text": "Likely N+1 query: `for eval_template in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/eval_group.py:248"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `eval_template.config.get` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f0c6ee926d87286", "name": "Likely N+1 query: `for conversation in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/performance.py:328", "shortDescription": {"text": "Likely N+1 query: `for conversation in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/performance.py:328"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `conversation.nodes.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0478100c29979dfb", "name": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiment_feedback_v2.py:392", "shortDescription": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiment_feedback_v2.py:392"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `cell.column.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f38edf3549b48299", "name": "Commented-code block (16 lines) in futureagi/model_hub/views/run_prompt.py:1509", "shortDescription": {"text": "Commented-code block (16 lines) in futureagi/model_hub/views/run_prompt.py:1509"}, "fullDescription": {"text": "15 of 16 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1417c0f37079ffc9", "name": "Commented-code block (8 lines) in futureagi/model_hub/views/metric.py:165", "shortDescription": {"text": "Commented-code block (8 lines) in futureagi/model_hub/views/metric.py:165"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1da9d32fccba7320", "name": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/views/develop_optimiser.py:16", "shortDescription": {"text": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/views/develop_optimiser.py:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-782057a808093517", "name": "Commented-code block (7 lines) in futureagi/model_hub/views/develop_optimiser.py:477", "shortDescription": {"text": "Commented-code block (7 lines) in futureagi/model_hub/views/develop_optimiser.py:477"}, "fullDescription": {"text": "6 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-0885513342a15678", "name": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_optimiser.py:93", "shortDescription": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_optimiser.py:93"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `cell.column.data_type` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-769df1f78df3fce6", "name": "Likely N+1 query: `for label in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_annotations.py:251", "shortDescription": {"text": "Likely N+1 query: `for label in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_annotations.py:251"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `label.settings.get` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ec92cf683b1d7d6", "name": "Legacy-named symbol `config_copy` in futureagi/model_hub/views/custom_model.py:255", "shortDescription": {"text": "Legacy-named symbol `config_copy` in futureagi/model_hub/views/custom_model.py:255"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2bf9b2af173a42a", "name": "Likely N+1 query: `for ov in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/prompt_labels.py:308", "shortDescription": {"text": "Likely N+1 query: `for ov in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/prompt_labels.py:308"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ov.labels.remove` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9318ae0f47773d5e", "name": "Likely N+1 query: `for note in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/scores.py:816", "shortDescription": {"text": "Likely N+1 query: `for note in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/scores.py:816"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `note.queue_item.queue` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c334262233e9b404", "name": "Commented-code block (6 lines) in futureagi/model_hub/views/prompt_template.py:962", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/model_hub/views/prompt_template.py:962"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-83c1ab6343ac7f44", "name": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/prompt_template.py:2130", "shortDescription": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/prompt_template.py:2130"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `config.eval_template.config` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dda1f3d315b386c4", "name": "Commented-code block (8 lines) in futureagi/model_hub/views/develop_dataset.py:993", "shortDescription": {"text": "Commented-code block (8 lines) in futureagi/model_hub/views/develop_dataset.py:993"}, "fullDescription": {"text": "4 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-332c095682694b59", "name": "Likely N+1 query: `for column in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_dataset.py:1631", "shortDescription": {"text": "Likely N+1 query: `for column in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_dataset.py:1631"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `column.cell_set.filter` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33c4cd535996d4a6", "name": "Stub function `_handle_upload_file` (body is just `pass`/`return`) \u2014 futureagi/model_hub/views/develop_dataset.py:5908", "shortDescription": {"text": "Stub function `_handle_upload_file` (body is just `pass`/`return`) \u2014 futureagi/model_hub/views/develop_dataset.py:5908"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e46bde641bf08db", "name": "Legacy-named symbol `fields_to_copy` in futureagi/model_hub/views/separate_evals.py:7885", "shortDescription": {"text": "Legacy-named symbol `fields_to_copy` in futureagi/model_hub/views/separate_evals.py:7885"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e594d4ce61cc76c3", "name": "Likely N+1 query: `for v in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/separate_evals.py:2561", "shortDescription": {"text": "Likely N+1 query: `for v in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/separate_evals.py:2561"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `v.created_by.email` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f8a39793d44c86e", "name": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/datasets/add_rows/existing_datase", "shortDescription": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/datasets/add_rows/existing_dataset.py:239"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `cell.column.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d96ed48d59f0d8f", "name": "Commented-code block (5 lines) in futureagi/model_hub/views/datasets/add_rows/huggingface.py:260", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/model_hub/views/datasets/add_rows/huggingface.py:260"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-b37bfacd20dc7d69", "name": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/datasets/create/dataset_from_ex", "shortDescription": {"text": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/datasets/create/dataset_from_experiment.py:304"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `metric.template.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7b689c7f21d2e38", "name": "Commented-code block (5 lines) in futureagi/model_hub/views/utils/evals.py:736", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/model_hub/views/utils/evals.py:736"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-3338aaf60c61316a", "name": "Commented-code block (6 lines) in futureagi/simulate/admin.py:9", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/simulate/admin.py:9"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ceb0140579ad899c", "name": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/models/agent_definition.py:265", "shortDescription": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/models/agent_definition.py:265"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a963e82935fa106", "name": "Commented-code block (6 lines) in futureagi/simulate/constants/installation_guide.py:22", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/simulate/constants/installation_guide.py:22"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-6cc485ede76301ea", "name": "Likely N+1 query: `for t in \u2026` triggers a query per row \u2014 futureagi/simulate/utils/agent_optimiser.py:1036", "shortDescription": {"text": "Likely N+1 query: `for t in \u2026` triggers a query per row \u2014 futureagi/simulate/utils/agent_optimiser.py:1036"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `t.speaker_role.upper` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13b08bfb61faddad", "name": "Likely N+1 query: `for ce in \u2026` triggers a query per row \u2014 futureagi/simulate/tasks/chat_sim.py:574", "shortDescription": {"text": "Likely N+1 query: `for ce in \u2026` triggers a query per row \u2014 futureagi/simulate/tasks/chat_sim.py:574"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ce.test_execution.run_test` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93c5a1c8b1dd4516", "name": "Commented-code block (8 lines) in futureagi/simulate/temporal/client.py:279", "shortDescription": {"text": "Commented-code block (8 lines) in futureagi/simulate/temporal/client.py:279"}, "fullDescription": {"text": "6 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-aff451045ae9d210", "name": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/temporal/activities/xl.py:443", "shortDescription": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/temporal/activities/xl.py:443"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9816d630069174d", "name": "Commented-code block (8 lines) in futureagi/simulate/serializers/persona.py:374", "shortDescription": {"text": "Commented-code block (8 lines) in futureagi/simulate/serializers/persona.py:374"}, "fullDescription": {"text": "6 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-7d2e893a4decd070", "name": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/services/agent_definition.py:86", "shortDescription": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/services/agent_definition.py:86"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38981a7d8d972e13", "name": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/services/hosted_runner.py:864", "shortDescription": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/services/hosted_runner.py:864"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24386336244c2791", "name": "Legacy-named symbol `_create_persona_scenarios_legacy` in futureagi/simulate/services/alk_simulate_ingestion.py:427", "shortDescription": {"text": "Legacy-named symbol `_create_persona_scenarios_legacy` in futureagi/simulate/services/alk_simulate_ingestion.py:427"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01073cfb1c543e94", "name": "Legacy-named symbol `datadir_copy` in futureagi/simulate/services/hosted_harness_gateway.py:57", "shortDescription": {"text": "Legacy-named symbol `datadir_copy` in futureagi/simulate/services/hosted_harness_gateway.py:57"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0a64e9c46e650ae", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/simulate/services/hosted_harness_gateway.py:362", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/simulate/services/hosted_harness_gateway.py:362"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-b944b5036c28f942", "name": "Likely N+1 query: `for creds in \u2026` triggers a query per row \u2014 futureagi/simulate/migrations/0076_backfill_provider_crede", "shortDescription": {"text": "Likely N+1 query: `for creds in \u2026` triggers a query per row \u2014 futureagi/simulate/migrations/0076_backfill_provider_credentials.py:48"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `creds.agent_version.agent_definition_id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ca760df484342d5", "name": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/migrations/0075_add_agent_version_to_provider_credentials", "shortDescription": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/migrations/0075_add_agent_version_to_provider_credentials.py:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83e784a2c718d299", "name": "Commented-code block (8 lines) in futureagi/simulate/views/scenarios.py:938", "shortDescription": {"text": "Commented-code block (8 lines) in futureagi/simulate/views/scenarios.py:938"}, "fullDescription": {"text": "6 of 8 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-c3849c1aa49d8cfc", "name": "Commented-code block (13 lines) in futureagi/simulate/views/call_transcript.py:218", "shortDescription": {"text": "Commented-code block (13 lines) in futureagi/simulate/views/call_transcript.py:218"}, "fullDescription": {"text": "8 of 13 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-38823ded62dc1fbf", "name": "Likely N+1 query: `for call_execution in \u2026` triggers a query per row \u2014 futureagi/simulate/views/call_transcript.py:139", "shortDescription": {"text": "Likely N+1 query: `for call_execution in \u2026` triggers a query per row \u2014 futureagi/simulate/views/call_transcript.py:139"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `call_execution.transcripts.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d867681760cfdd41", "name": "Likely N+1 query: `for item in \u2026` triggers a query per row \u2014 futureagi/simulate/views/agent_prompt_optimiser.py:585", "shortDescription": {"text": "Likely N+1 query: `for item in \u2026` triggers a query per row \u2014 futureagi/simulate/views/agent_prompt_optimiser.py:585"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `item.component_evaluations.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-445fd5d34e794319", "name": "Likely N+1 query: `for gcp_account in \u2026` triggers a query per row \u2014 futureagi/accounts/gcp_marketplace_utils.py:356", "shortDescription": {"text": "Likely N+1 query: `for gcp_account in \u2026` triggers a query per row \u2014 futureagi/accounts/gcp_marketplace_utils.py:356"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gcp_account.organization.members` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cd36b1a357328a3", "name": "Commented-code block (6 lines) in futureagi/accounts/user_onboard.py:1139", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/accounts/user_onboard.py:1139"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-6e198f53d1f5c11f", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/utils.py:659", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/utils.py:659"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bc4112c1a3dd3c0", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/organization_membership.py:74", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/organization_membership.py:74"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-425257584c57f982", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/workspace.py:104", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/workspace.py:104"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef32876bb624453c", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/user.py:133", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/user.py:133"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b085c5f209e29c7c", "name": "Likely N+1 query: `for row in \u2026` triggers a query per row \u2014 futureagi/accounts/management/commands/export_gcp_marketplac", "shortDescription": {"text": "Likely N+1 query: `for row in \u2026` triggers a query per row \u2014 futureagi/accounts/management/commands/export_gcp_marketplace_usage.py:84"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `row.entitlement.plan_id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84890f6b8b2b4354", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/services/workspace_members.py:121", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/services/workspace_members.py:121"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4be96504de0dce16", "name": "Likely N+1 query: `for ws_mem in \u2026` triggers a query per row \u2014 futureagi/accounts/services/workspace_members.py:125", "shortDescription": {"text": "Likely N+1 query: `for ws_mem in \u2026` triggers a query per row \u2014 futureagi/accounts/services/workspace_members.py:125"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ws_mem.created_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bceac384be06d99", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/services/member_role_service.py:220", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/services/member_role_service.py:220"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd9626b9229246d2", "name": "Commented-code block (6 lines) in futureagi/accounts/services/gcp_procurement.py:146", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/accounts/services/gcp_procurement.py:146"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-0b46060d2bc87c5f", "name": "Stub function `noop` (body is just `pass`/`return`) \u2014 futureagi/accounts/migrations/0022_backfill_ws_org_membership_fk.p", "shortDescription": {"text": "Stub function `noop` (body is just `pass`/`return`) \u2014 futureagi/accounts/migrations/0022_backfill_ws_org_membership_fk.py:67"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffdf701d2d6fbc6f", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/rbac_views.py:118", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/rbac_views.py:118"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5d86e3e33e6faba", "name": "Likely N+1 query: `for mem in \u2026` triggers a query per row \u2014 futureagi/accounts/views/rbac_views.py:677", "shortDescription": {"text": "Likely N+1 query: `for mem in \u2026` triggers a query per row \u2014 futureagi/accounts/views/rbac_views.py:677"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `mem.joined_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5336b30126f3229d", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/signup.py:937", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/signup.py:937"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b90771b957ccaee", "name": "Commented-code block (6 lines) in futureagi/accounts/views/workspace.py:287", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/accounts/views/workspace.py:287"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-b449cb82824a3079", "name": "Likely N+1 query: `for workspace in \u2026` triggers a query per row \u2014 futureagi/accounts/views/workspace.py:108", "shortDescription": {"text": "Likely N+1 query: `for workspace in \u2026` triggers a query per row \u2014 futureagi/accounts/views/workspace.py:108"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `workspace.created_at.strftime` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02b139e1cf896dc3", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/organization_selection.py:125", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/organization_selection.py:125"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-176fd36869cf349e", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/workspace_management.py:265", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/workspace_management.py:265"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66a5a2df4a94621b", "name": "Commented-code block (6 lines) in futureagi/accounts/views/workspace_management.py:2178", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/accounts/views/workspace_management.py:2178"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-ff42d4d733418935", "name": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/user.py:838", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/user.py:838"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fb24beb40ea08d0", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentcc/services/email_sender.py:115", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentcc/services/email_sender.py:115"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-097830394b8d3f4a", "name": "Legacy-named symbol `check_copy` in futureagi/agentcc/views/org_config.py:117", "shortDescription": {"text": "Legacy-named symbol `check_copy` in futureagi/agentcc/views/org_config.py:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3eed387c72b8bac1", "name": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tfc/settings/settings.py:2131", "shortDescription": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tfc/settings/settings.py:2131"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0135d27db10891ce", "name": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/tfc/utils/functions.py:518", "shortDescription": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/tfc/utils/functions.py:518"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `cell.value.replace` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19ee38bb9dfc8cae", "name": "Stub function `load_model` (body is just `pass`/`return`) \u2014 futureagi/tfc/utils/distributed_locks.py:475", "shortDescription": {"text": "Stub function `load_model` (body is just `pass`/`return`) \u2014 futureagi/tfc/utils/distributed_locks.py:475"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f109e13dfa591f75", "name": "Commented-code block (13 lines) in futureagi/tfc/utils/storage.py:940", "shortDescription": {"text": "Commented-code block (13 lines) in futureagi/tfc/utils/storage.py:940"}, "fullDescription": {"text": "12 of 13 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-9c478969df839e3b", "name": "Commented-code block (5 lines) in futureagi/tfc/utils/clickhouse.py:161", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/tfc/utils/clickhouse.py:161"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-f3a5d338e652cf22", "name": "Commented-code block (6 lines) in futureagi/tfc/utils/validations.py:174", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/tfc/utils/validations.py:174"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a2e83be08c339f3e", "name": "Commented-code block (5 lines) in futureagi/tfc/utils/distributed_examples.py:24", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/tfc/utils/distributed_examples.py:24"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-e161ea26a5abb259", "name": "Legacy-named symbol `pubsub_v1` in futureagi/tfc/temporal/marketplace/activities.py:60", "shortDescription": {"text": "Legacy-named symbol `pubsub_v1` in futureagi/tfc/temporal/marketplace/activities.py:60"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6657d9e87ae89ced", "name": "Stub function `_noop_worker_loop` (body is just `pass`/`return`) \u2014 futureagi/tfc/temporal/common/worker.py:83", "shortDescription": {"text": "Stub function `_noop_worker_loop` (body is just `pass`/`return`) \u2014 futureagi/tfc/temporal/common/worker.py:83"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-755bd08da6b346f3", "name": "Commented-code block (11 lines) in futureagi/tfc/temporal/schedules/tracer.py:18", "shortDescription": {"text": "Commented-code block (11 lines) in futureagi/tfc/temporal/schedules/tracer.py:18"}, "fullDescription": {"text": "7 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-fc00d2c1a484fff7", "name": "Commented-code block (14 lines) in futureagi/tfc/temporal/schedules/simulate.py:14", "shortDescription": {"text": "Commented-code block (14 lines) in futureagi/tfc/temporal/schedules/simulate.py:14"}, "fullDescription": {"text": "14 of 14 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-905743918995fe9a", "name": "Blocking `time.sleep(...)` inside `async def check_status` \u2014 futureagi/tfc/management/commands/debug_temporal.py:180", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def check_status` \u2014 futureagi/tfc/management/commands/debug_temporal.py:180"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f00c7c32644c24aa", "name": "Stub function `_noop` (body is just `pass`/`return`) \u2014 futureagi/tfc/management/commands/start_temporal_worker.py:159", "shortDescription": {"text": "Stub function `_noop` (body is just `pass`/`return`) \u2014 futureagi/tfc/management/commands/start_temporal_worker.py:159"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8475b6794e33902d", "name": "Legacy-named symbol `level_or_legacy` in futureagi/tfc/permissions/utils.py:54", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/tfc/permissions/utils.py:54"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5062646086de14d0", "name": "Legacy-named symbol `level_or_legacy` in futureagi/tfc/permissions/rbac.py:38", "shortDescription": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/tfc/permissions/rbac.py:38"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-601be0bdd0c1e466", "name": "Legacy-named symbol `explore_trace_legacy` in futureagi/ai_tools/tools/__init__.py:228", "shortDescription": {"text": "Legacy-named symbol `explore_trace_legacy` in futureagi/ai_tools/tools/__init__.py:228"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47c21fb817822df6", "name": "Likely N+1 query: `for em in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/datasets/run_dataset_evals.py:83", "shortDescription": {"text": "Likely N+1 query: `for em in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/datasets/run_dataset_evals.py:83"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `em.config.get` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abfe4c0bcf79214b", "name": "Likely N+1 query: `for wm in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/users/get_user.py:73", "shortDescription": {"text": "Likely N+1 query: `for wm in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/users/get_user.py:73"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `wm.workspace.organization` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86abed966b35249c", "name": "Likely N+1 query: `for test_execution in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/simulation/rerun_test_ex", "shortDescription": {"text": "Likely N+1 query: `for test_execution in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/simulation/rerun_test_execution.py:266"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `test_execution.execution_metadata.get` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faafbe4a0633fedc", "name": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/simulation/get_call_logs.py:88", "shortDescription": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/simulation/get_call_logs.py:88"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `log.logged_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2bd500def10372fc", "name": "Likely N+1 query: `for ann in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/annotations/list_annotations.py:54", "shortDescription": {"text": "Likely N+1 query: `for ann in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/annotations/list_annotations.py:54"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ann.dataset.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4259f6bfa10faedd", "name": "Likely N+1 query: `for lbl in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/annotations/get_annotation.py:80", "shortDescription": {"text": "Likely N+1 query: `for lbl in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/annotations/get_annotation.py:80"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `lbl.settings.get` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb28d0a9ad1a5292", "name": "Legacy-named symbol `fields_to_copy` in futureagi/ai_tools/tools/evaluations/duplicate_eval_template.py:92", "shortDescription": {"text": "Legacy-named symbol `fields_to_copy` in futureagi/ai_tools/tools/evaluations/duplicate_eval_template.py:92"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-895a408bcc6f9a91", "name": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/get_eval_logs.py:105", "shortDescription": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/get_eval_logs.py:105"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `log.created_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-449549b18ef75163", "name": "Likely N+1 query: `for ev in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/list_evaluations.py:66", "shortDescription": {"text": "Likely N+1 query: `for ev in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/list_evaluations.py:66"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `ev.eval_template.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a40bcbfff570874c", "name": "Likely N+1 query: `for g in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/list_eval_groups.py:52", "shortDescription": {"text": "Likely N+1 query: `for g in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/list_eval_groups.py:52"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `g.eval_templates.count` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14b8e8a03ed8b4a0", "name": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/agents/list_scenarios.py:78", "shortDescription": {"text": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/agents/list_scenarios.py:78"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `s.agent_definition.agent_name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9610d9a1610945bc", "name": "Likely N+1 query: `for e in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/get_eval_task.py:50", "shortDescription": {"text": "Likely N+1 query: `for e in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/get_eval_task.py:50"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `e.eval_template.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87af4fbd8dd52c4c", "name": "Likely N+1 query: `for task in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_eval_tasks.py:85", "shortDescription": {"text": "Likely N+1 query: `for task in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_eval_tasks.py:85"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `task.evals.filter` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-307086aabfc7d195", "name": "Likely N+1 query: `for trace in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/search_traces.py:74", "shortDescription": {"text": "Likely N+1 query: `for trace in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/search_traces.py:74"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `trace.project.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9d510c018a1ecaa", "name": "Legacy-named symbol `explore_trace_legacy` in futureagi/ai_tools/tools/tracing/explore_trace.py:29", "shortDescription": {"text": "Legacy-named symbol `explore_trace_legacy` in futureagi/ai_tools/tools/tracing/explore_trace.py:29"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f0d1c81954186f8", "name": "Likely N+1 query: `for trace in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/analyze_errors.py:113", "shortDescription": {"text": "Likely N+1 query: `for trace in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/analyze_errors.py:113"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `trace.project.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6fd4201eea03660", "name": "Likely N+1 query: `for score in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_trace_scores.py:150", "shortDescription": {"text": "Likely N+1 query: `for score in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_trace_scores.py:150"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `score.label.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d05562d1864ce2c", "name": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_sessions.py:65", "shortDescription": {"text": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_sessions.py:65"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `s.project.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-117f5ec41ca1b57f", "name": "Likely N+1 query: `for exp in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/experiments/list_experiments.py:58", "shortDescription": {"text": "Likely N+1 query: `for exp in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/experiments/list_experiments.py:58"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `exp.dataset.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2d1df5cfe62deab", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/run_tests.py:31", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/run_tests.py:31"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-e19c7b700f08f084", "name": "Legacy-named symbol `dataset_v2` in futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py:135", "shortDescription": {"text": "Legacy-named symbol `dataset_v2` in futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py:135"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df766f05e7a7fa96", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py:47"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-95af07da5e1abd9c", "name": "Legacy-named symbol `_litellm_response_old` in futureagi/agentic_eval/core_evals/run_prompt/litellm_response.py:1883", "shortDescription": {"text": "Legacy-named symbol `_litellm_response_old` in futureagi/agentic_eval/core_evals/run_prompt/litellm_response.py:1883"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f52cd1a9fb0d9b8", "name": "Legacy-named symbol `scribe_v1` in futureagi/agentic_eval/core_evals/run_prompt/available_models.py:349", "shortDescription": {"text": "Legacy-named symbol `scribe_v1` in futureagi/agentic_eval/core_evals/run_prompt/available_models.py:349"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a793aa51deece5c", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/cart", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/cartesia_response.py:239"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-9cb954195173eaea", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/hume", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/hume_response.py:100"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-31a1a44731b8e3dc", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/neup", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/neuphonic_response.py:166"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-2ae8bcddd3b043b0", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/lmnt", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/lmnt_response.py:179"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-14fc7dd1f4de6ee8", "name": "Legacy-named symbol `scribe_v1` in futureagi/agentic_eval/core_evals/run_prompt/other_services/elevenlabs_response.py:25", "shortDescription": {"text": "Legacy-named symbol `scribe_v1` in futureagi/agentic_eval/core_evals/run_prompt/other_services/elevenlabs_response.py:251"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2feac9183ae769ef", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/inwo", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/inworld_response.py:84"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-9945e70ef3d98ac4", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/rime", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/rime_response.py:135"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-763b65b354141887", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/deep", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/deepgram_response.py:91"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-2c412f5749b6dfe1", "name": "Stub function `to_config` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/base_evaluator.py:", "shortDescription": {"text": "Stub function `to_config` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/base_evaluator.py:68"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3071a64420a925e5", "name": "Stub function `handle_data` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/functio", "shortDescription": {"text": "Stub function `handle_data` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/functions.py:3335"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecf6ca377f74fd35", "name": "Stub function `_model` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/function_eva", "shortDescription": {"text": "Stub function `_model` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/function_evaluator.py:22"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1b51febe4555873", "name": "Stub function `compare` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/grounded/similarity.", "shortDescription": {"text": "Stub function `compare` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/grounded/similarity.py:8"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb9b446570e04ab7", "name": "Stub function `_model` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/grounded/grounded_eva", "shortDescription": {"text": "Stub function `_model` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/grounded/grounded_evaluator.py:29"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ec777c536b9c71a", "name": "Legacy-named symbol `qualitative_eval_parameter_prompt_v2` in futureagi/agentic_eval/core/utils/functions.py:31", "shortDescription": {"text": "Legacy-named symbol `qualitative_eval_parameter_prompt_v2` in futureagi/agentic_eval/core/utils/functions.py:31"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b590cb419ce4559f", "name": "Commented-code block (11 lines) in futureagi/tracer/urls.py:96", "shortDescription": {"text": "Commented-code block (11 lines) in futureagi/tracer/urls.py:96"}, "fullDescription": {"text": "8 of 11 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-1c220b87d4e830b5", "name": "Commented-code block (7 lines) in futureagi/tracer/utils/graphs.py:421", "shortDescription": {"text": "Commented-code block (7 lines) in futureagi/tracer/utils/graphs.py:421"}, "fullDescription": {"text": "7 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-4f6e67b7187a86f3", "name": "Legacy-named symbol `config_copy` in futureagi/tracer/utils/graphs_optimized.py:340", "shortDescription": {"text": "Legacy-named symbol `config_copy` in futureagi/tracer/utils/graphs_optimized.py:340"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5047446f6b9cd8ce", "name": "Commented-code block (7 lines) in futureagi/tracer/utils/replay_session.py:550", "shortDescription": {"text": "Commented-code block (7 lines) in futureagi/tracer/utils/replay_session.py:550"}, "fullDescription": {"text": "5 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-7bd4257113c57586", "name": "Legacy-named symbol `_bulk_create_with_copy` in futureagi/tracer/utils/trace_ingestion.py:211", "shortDescription": {"text": "Legacy-named symbol `_bulk_create_with_copy` in futureagi/tracer/utils/trace_ingestion.py:211"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc485ba67893b478", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_backfill.py:110", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_backfill.py:110"}, "fullDescription": {"text": "`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-e11aada264820e52", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_doctor.py:80", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_doctor.py:80"}, "fullDescription": {"text": "`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-0a377c303e1b218e", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_remove_pg.py:72", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_remove_pg.py:72"}, "fullDescription": {"text": "`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-4205fad77d8485ad", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_validate.py:91", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_validate.py:91"}, "fullDescription": {"text": "`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-f5b0539b12f5a66b", "name": "Legacy-named symbol `physical_latest_users_v1` in futureagi/tracer/services/users_list_manager.py:84", "shortDescription": {"text": "Legacy-named symbol `physical_latest_users_v1` in futureagi/tracer/services/users_list_manager.py:84"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-925c732514bb20c4", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/services/observability_providers.py:195", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/services/observability_providers.py:195"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-52992664012b663c", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/graph_dispatch.py:161", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/graph_dispatch.py:161"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a59d034dfcf0012a", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/exact_graph_reads.py:82", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/exact_graph_reads.py:82"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cd1308965312dcd", "name": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/schema.py:87", "shortDescription": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/schema.py:87"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f737dfe9a73d4771", "name": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tracer/services/clickhouse/eval_logger_table.py:5", "shortDescription": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tracer/services/clickhouse/eval_logger_table.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd4b9242dbcccc51", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/filter_value_reads.py:38", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/filter_value_reads.py:38"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc7d63f0fd5f7640", "name": "Legacy-named symbol `ch25_no_v2_class_falling_back_to_v1` in futureagi/tracer/services/clickhouse/v2/shadowed_builder.py", "shortDescription": {"text": "Legacy-named symbol `ch25_no_v2_class_falling_back_to_v1` in futureagi/tracer/services/clickhouse/v2/shadowed_builder.py:105"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e632ff7ba57cee2", "name": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/span_reader.py:1978", "shortDescription": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/span_reader.py:1978"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1284ce0e567678a", "name": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/apply_schema.py:27", "shortDescription": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/apply_schema.py:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47f23c023b344262", "name": "Legacy-named symbol `rows_v1` in futureagi/tracer/services/clickhouse/v2/shadow.py:58", "shortDescription": {"text": "Legacy-named symbol `rows_v1` in futureagi/tracer/services/clickhouse/v2/shadow.py:58"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a940ffa66a9e34e7", "name": "Legacy-named symbol `use_v2` in futureagi/tracer/services/clickhouse/v2/dispatch.py:148", "shortDescription": {"text": "Legacy-named symbol `use_v2` in futureagi/tracer/services/clickhouse/v2/dispatch.py:148"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c04673499735c058", "name": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/adapter.py:61", "shortDescription": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/adapter.py:61"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-443321d5f10f42bc", "name": "Legacy-named symbol `ch25_shadow_requested_but_no_v2_class_falling_back_to_v1` in futureagi/tracer/services/clickhouse/v", "shortDescription": {"text": "Legacy-named symbol `ch25_shadow_requested_but_no_v2_class_falling_back_to_v1` in futureagi/tracer/services/clickhouse/v2/run_query.py:115"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb57dd35dbbe7e6d", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/v2/query_builders/filters.py:270", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/v2/query_builders/filters.py:270"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5968b92605d04a2e", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/v2/query_builders/_rewrite.py:23", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/v2/query_builders/_rewrite.py:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-763d2367f7221daa", "name": "Legacy-named symbol `expected_v1` in futureagi/tracer/services/clickhouse/v2/property_catalog/span_source.py:292", "shortDescription": {"text": "Legacy-named symbol `expected_v1` in futureagi/tracer/services/clickhouse/v2/property_catalog/span_source.py:292"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d39725dbae3de973", "name": "Legacy-named symbol `is_v2` in futureagi/tracer/services/clickhouse/query_builders/voice_call_list.py:1176", "shortDescription": {"text": "Legacy-named symbol `is_v2` in futureagi/tracer/services/clickhouse/query_builders/voice_call_list.py:1176"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7588072dd170e0b9", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/exact_graph_predicates", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/exact_graph_predicates.py:638"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f78983ead6f63cfb", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/user_list.py:434", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/user_list.py:434"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9916bdfddb312e01", "name": "Legacy-named symbol `standalone_v2` in futureagi/tracer/services/clickhouse/query_builders/dashboard.py:253", "shortDescription": {"text": "Legacy-named symbol `standalone_v2` in futureagi/tracer/services/clickhouse/query_builders/dashboard.py:253"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2292d5f06518472", "name": "Stub function `recommended_filter_cursor_seed_batch_size` (body is just `pass`/`return`) \u2014 futureagi/tracer/services/cli", "shortDescription": {"text": "Stub function `recommended_filter_cursor_seed_batch_size` (body is just `pass`/`return`) \u2014 futureagi/tracer/services/clickhouse/query_builders/session_list.py:843"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83c0b12824fa65dc", "name": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tracer/services/clickhouse/query_builders/filters.py:2491", "shortDescription": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tracer/services/clickhouse/query_builders/filters.py:2491"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3871a5a18561f555", "name": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/query_builders/base.py:145", "shortDescription": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/query_builders/base.py:145"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-517dae84fb6fc484", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/time_series.py:853", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/time_series.py:853"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55d81de28c878a00", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/latest_filter_predicat", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/latest_filter_predicates.py:1339"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aabf4ab6c3003c2", "name": "Legacy-named symbol `input_backup` in futureagi/tracer/migrations/0038_observationspan_input_backup_and_more.py:15", "shortDescription": {"text": "Legacy-named symbol `input_backup` in futureagi/tracer/migrations/0038_observationspan_input_backup_and_more.py:15"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d0e45321573814b", "name": "Legacy-named symbol `input_backup` in futureagi/tracer/migrations/0039_remove_observationspan_input_backup_and_more.py:1", "shortDescription": {"text": "Legacy-named symbol `input_backup` in futureagi/tracer/migrations/0039_remove_observationspan_input_backup_and_more.py:15"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-571bc4a827a7c107", "name": "Likely N+1 query: `for issue in \u2026` triggers a query per row \u2014 futureagi/tracer/queries/scan_clustering.py:131", "shortDescription": {"text": "Likely N+1 query: `for issue in \u2026` triggers a query per row \u2014 futureagi/tracer/queries/scan_clustering.py:131"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `issue.scan_result.key_moments` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7187b598eff37e10", "name": "Legacy-named symbol `after_old` in futureagi/tracer/selectors/eval_tasks/continuous_candidates.py:984", "shortDescription": {"text": "Legacy-named symbol `after_old` in futureagi/tracer/selectors/eval_tasks/continuous_candidates.py:984"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1feffd6072d0908c", "name": "Legacy-named symbol `project_batches_v1` in futureagi/tracer/views/dashboard.py:486", "shortDescription": {"text": "Legacy-named symbol `project_batches_v1` in futureagi/tracer/views/dashboard.py:486"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b7de4c5fbd3122e", "name": "Likely N+1 query: `for a in \u2026` triggers a query per row \u2014 futureagi/tracer/views/dashboard.py:6583", "shortDescription": {"text": "Likely N+1 query: `for a in \u2026` triggers a query per row \u2014 futureagi/tracer/views/dashboard.py:6583"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `a.observability_provider.project` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e22037a43d40526", "name": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/observation_span.py:4397", "shortDescription": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/observation_span.py:4397"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `config.eval_template.choices` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9298f4aaf02c7be", "name": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/tracer/views/eval_task.py:2548", "shortDescription": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/tracer/views/eval_task.py:2548"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `log.created_at.isoformat` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b55453dc9e08a07", "name": "Likely N+1 query: `for note in \u2026` triggers a query per row \u2014 futureagi/tracer/views/annotation.py:457", "shortDescription": {"text": "Likely N+1 query: `for note in \u2026` triggers a query per row \u2014 futureagi/tracer/views/annotation.py:457"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `note.created_by_user.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11ca7d5ddbe6f05c", "name": "Legacy-named symbol `fetch_graph_v2` in futureagi/tracer/views/charts.py:233", "shortDescription": {"text": "Legacy-named symbol `fetch_graph_v2` in futureagi/tracer/views/charts.py:233"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-020c4af82e4bb908", "name": "Commented-code block (7 lines) in futureagi/tracer/views/project_version.py:978", "shortDescription": {"text": "Commented-code block (7 lines) in futureagi/tracer/views/project_version.py:978"}, "fullDescription": {"text": "6 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-95966ffdf66e29ee", "name": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/project_version.py:271", "shortDescription": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/project_version.py:271"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `config.eval_template.choices` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fff69b8513f6038", "name": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/trace.py:3345", "shortDescription": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/trace.py:3345"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `config.eval_template.choices` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d74c8c1892bfddc", "name": "Likely N+1 query: `for score in \u2026` triggers a query per row \u2014 futureagi/tracer/views/trace_session.py:3634", "shortDescription": {"text": "Likely N+1 query: `for score in \u2026` triggers a query per row \u2014 futureagi/tracer/views/trace_session.py:3634"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `score.label.type` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2af5cb61479bd1c", "name": "Legacy-named symbol `StandaloneEvalView_v2` in futureagi/sdk/urls.py:14", "shortDescription": {"text": "Legacy-named symbol `StandaloneEvalView_v2` in futureagi/sdk/urls.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c824f370fe2fb448", "name": "Legacy-named symbol `standalone_v2` in futureagi/sdk/utils/evaluations.py:40", "shortDescription": {"text": "Legacy-named symbol `standalone_v2` in futureagi/sdk/utils/evaluations.py:40"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75ed157ebb446a5a", "name": "Legacy-named symbol `StandaloneEvalView_v2` in futureagi/sdk/views/evaluations.py:232", "shortDescription": {"text": "Legacy-named symbol `StandaloneEvalView_v2` in futureagi/sdk/views/evaluations.py:232"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48a1ba46a8522fe0", "name": "Commented-code block (19 lines) in futureagi/ee/usage/apps.py:36", "shortDescription": {"text": "Commented-code block (19 lines) in futureagi/ee/usage/apps.py:36"}, "fullDescription": {"text": "19 of 19 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a668cacd59ac23de", "name": "Commented-code block (7 lines) in futureagi/ee/usage/models/__init__.py:1", "shortDescription": {"text": "Commented-code block (7 lines) in futureagi/ee/usage/models/__init__.py:1"}, "fullDescription": {"text": "7 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-bef25aef7e161f08", "name": "Commented-code block (6 lines) in futureagi/ee/usage/utils/usage_entries.py:1982", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/ee/usage/utils/usage_entries.py:1982"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-4f2d89650fedf2ae", "name": "Stub function `check_if_row_limit_reached` (body is just `pass`/`return`) \u2014 futureagi/ee/usage/utils/usage_entries.py:21", "shortDescription": {"text": "Stub function `check_if_row_limit_reached` (body is just `pass`/`return`) \u2014 futureagi/ee/usage/utils/usage_entries.py:2194"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ba6df37d3a9bed8", "name": "Legacy-named symbol `tag_for_reason_prompt_v2` in futureagi/ee/agenthub/tags_generation_agent/tags_v2.py:8", "shortDescription": {"text": "Legacy-named symbol `tag_for_reason_prompt_v2` in futureagi/ee/agenthub/tags_generation_agent/tags_v2.py:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4330921ff483fa0", "name": "Legacy-named symbol `tag_for_reason_prompt_v2` in futureagi/ee/agenthub/tags_generation_agent/prompt.py:10", "shortDescription": {"text": "Legacy-named symbol `tag_for_reason_prompt_v2` in futureagi/ee/agenthub/tags_generation_agent/prompt.py:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfa118a3e9ffecee", "name": "Legacy-named symbol `data_copy` in futureagi/ee/agenthub/fix_your_agent/simulation_adapter.py:1833", "shortDescription": {"text": "Legacy-named symbol `data_copy` in futureagi/ee/agenthub/fix_your_agent/simulation_adapter.py:1833"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db840e5948183046", "name": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/traceerroragent/judge.py:19", "shortDescription": {"text": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/traceerroragent/judge.py:19"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e454f7561f26e84", "name": "Legacy-named symbol `_summarize_logic_v2` in futureagi/ee/agenthub/traceerroragent/traceerror.py:329", "shortDescription": {"text": "Legacy-named symbol `_summarize_logic_v2` in futureagi/ee/agenthub/traceerroragent/traceerror.py:329"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff0bdd60e4fa7039", "name": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/traceerroragent/chauffeur.py:16", "shortDescription": {"text": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/traceerroragent/chauffeur.py:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1ec8bf887ef2805", "name": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/explanation_agent/exp_agent.py:19", "shortDescription": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/explanation_agent/exp_agent.py:19"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-603c2d115cc6f1d8", "name": "Legacy-named symbol `agent_copy` in futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py:662", "shortDescription": {"text": "Legacy-named symbol `agent_copy` in futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py:662"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424f156c973f5ee", "name": "Commented-code block (10 lines) in futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py:948", "shortDescription": {"text": "Commented-code block (10 lines) in futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py:948"}, "fullDescription": {"text": "7 of 10 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-f0a22b2ae31918ac", "name": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/workflow_agent/auto_events_generator.py:16", "shortDescription": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/workflow_agent/auto_events_generator.py:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c947a0e67db3459f", "name": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/workflow_agent/agent_task.py:4", "shortDescription": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/workflow_agent/agent_task.py:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0fdff33b669e274", "name": "Legacy-named symbol `rag_rank_evaluation_agent_v2` in futureagi/ee/agenthub/text_eval_agent/eval_text_llm.py:8", "shortDescription": {"text": "Legacy-named symbol `rag_rank_evaluation_agent_v2` in futureagi/ee/agenthub/text_eval_agent/eval_text_llm.py:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2aaa0b76398bc462", "name": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py:6", "shortDescription": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py:6"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-811d250c053a2e31", "name": "Commented-code block (6 lines) in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py:753", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py:753"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-2ca9a11e1484d256", "name": "Legacy-named symbol `plan_details_copy` in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent_old.py:1479", "shortDescription": {"text": "Legacy-named symbol `plan_details_copy` in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent_old.py:1479"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d499ca71ba85e25c", "name": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/rag_rank_eval_agent/rag_rank_evaluation_agent_v2.py:15", "shortDescription": {"text": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/rag_rank_eval_agent/rag_rank_evaluation_agent_v2.py:15"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79cabcff4c626783", "name": "Legacy-named symbol `rag_analyze_subqueries_gain_prompt_old` in futureagi/ee/agenthub/rag_rank_eval_agent/prompts_v2.py:", "shortDescription": {"text": "Legacy-named symbol `rag_analyze_subqueries_gain_prompt_old` in futureagi/ee/agenthub/rag_rank_eval_agent/prompts_v2.py:79"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c2f8e2b93c0d714", "name": "Legacy-named symbol `_improve_prompt_old` in futureagi/ee/agenthub/prompt_generate_agent/prompt_generate.py:564", "shortDescription": {"text": "Legacy-named symbol `_improve_prompt_old` in futureagi/ee/agenthub/prompt_generate_agent/prompt_generate.py:564"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1fc70d82b725b933", "name": "Likely N+1 query: `for eval_metric in \u2026` triggers a query per row \u2014 futureagi/ee/agenthub/prompt_optimizer_agent/agent_t", "shortDescription": {"text": "Likely N+1 query: `for eval_metric in \u2026` triggers a query per row \u2014 futureagi/ee/agenthub/prompt_optimizer_agent/agent_task_v2.py:291"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `eval_metric.template.id` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44b65dbbfef724dd", "name": "Stub function `_log_metrics` (body is just `pass`/`return`) \u2014 futureagi/ee/agenthub/prompt_optimizer_agent/agent_task_v2", "shortDescription": {"text": "Stub function `_log_metrics` (body is just `pass`/`return`) \u2014 futureagi/ee/agenthub/prompt_optimizer_agent/agent_task_v2.py:626"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed8667126f9b0137", "name": "Legacy-named symbol `eleven_multilingual_v2` in futureagi/ee/voice/services/vapi_service.py:335", "shortDescription": {"text": "Legacy-named symbol `eleven_multilingual_v2` in futureagi/ee/voice/services/vapi_service.py:335"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d682a69bd4808519", "name": "Likely N+1 query: `for call_exec in \u2026` triggers a query per row \u2014 futureagi/ee/voice/services/call_limit_service.py:195", "shortDescription": {"text": "Likely N+1 query: `for call_exec in \u2026` triggers a query per row \u2014 futureagi/ee/voice/services/call_limit_service.py:195"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `call_exec.call_execution.test_execution` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c93fd85fe31da675", "name": "Legacy-named symbol `summary_judgement_prompt_ragrank_v2` in futureagi/ee/prompts/eval_prompts.py:55", "shortDescription": {"text": "Legacy-named symbol `summary_judgement_prompt_ragrank_v2` in futureagi/ee/prompts/eval_prompts.py:55"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f1f4f5fc330f414", "name": "Legacy-named symbol `rag_rank_evaluation_agent_v2` in futureagi/ee/evals/futureagi/eval_ranking/evaluator.py:9", "shortDescription": {"text": "Legacy-named symbol `rag_rank_evaluation_agent_v2` in futureagi/ee/evals/futureagi/eval_ranking/evaluator.py:9"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c892449edd9b2901", "name": "Stub function `_no_op` (body is just `pass`/`return`) \u2014 futureagi/ee/evals/localizer/error_localizer.py:743", "shortDescription": {"text": "Stub function `_no_op` (body is just `pass`/`return`) \u2014 futureagi/ee/evals/localizer/error_localizer.py:743"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1833c1247c4bb36", "name": "Commented-code block (5 lines) in futureagi/ee/evals/llm/agent_evaluator/context/budget.py:29", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/ee/evals/llm/agent_evaluator/context/budget.py:29"}, "fullDescription": {"text": "3 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-995cb7fb9ed356c4", "name": "Legacy-named symbol `compacted_old` in futureagi/ee/falcon_ai/context_manager.py:109", "shortDescription": {"text": "Legacy-named symbol `compacted_old` in futureagi/ee/falcon_ai/context_manager.py:109"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf3aeb1d13171149", "name": "Likely N+1 query: `for f in \u2026` triggers a query per row \u2014 futureagi/ee/falcon_ai/consumers.py:774", "shortDescription": {"text": "Likely N+1 query: `for f in \u2026` triggers a query per row \u2014 futureagi/ee/falcon_ai/consumers.py:774"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `f.content_type.startswith` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4990a81c50a3631", "name": "Stub function `reverse_noop` (body is just `pass`/`return`) \u2014 futureagi/ee/falcon_ai/migrations/0007_global_builtin_skil", "shortDescription": {"text": "Stub function `reverse_noop` (body is just `pass`/`return`) \u2014 futureagi/ee/falcon_ai/migrations/0007_global_builtin_skills.py:31"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e092daf1df37e4c", "name": "Legacy-named symbol `embeddings_v2` in futureagi/ee/experiments/src/agent/tags.py:7", "shortDescription": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/experiments/src/agent/tags.py:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0991c9fb76867cc", "name": "Network/subprocess call without timeout or try/except \u2014 futureagi/saml2_auth/views.py:1039", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/saml2_auth/views.py:1039"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-a8cfd5b807c94d6f", "name": "Commented-code block (6 lines) in futureagi/saml2_auth/admin.py:23", "shortDescription": {"text": "Commented-code block (6 lines) in futureagi/saml2_auth/admin.py:23"}, "fullDescription": {"text": "6 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a59c050a2e045713", "name": "Stub function `ready` (body is just `pass`/`return`) \u2014 futureagi/saml2_auth/apps.py:8", "shortDescription": {"text": "Stub function `ready` (body is just `pass`/`return`) \u2014 futureagi/saml2_auth/apps.py:8"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb3073a965f7b17b", "name": "Commented-code block (5 lines) in futureagi/saml2_auth/models.py:57", "shortDescription": {"text": "Commented-code block (5 lines) in futureagi/saml2_auth/models.py:57"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-e8163b0718badc3e", "name": "Commented-code block (7 lines) in futureagi/saml2_auth/forms.py:41", "shortDescription": {"text": "Commented-code block (7 lines) in futureagi/saml2_auth/forms.py:41"}, "fullDescription": {"text": "5 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-bcfd81c5557c8c09", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/generate-agentcc-gateway-contracts.py:256", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/generate-agentcc-gateway-contracts.py:256"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-3572a7aa39aa3587", "name": "Legacy-named symbol `tracer_eval_logger_v2` in scripts/qa/replay_observe_queries_readonly.py:117", "shortDescription": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in scripts/qa/replay_observe_queries_readonly.py:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b00c724cd8a1e38", "name": "Legacy-named symbol `rewrite_v1_sql_to_v2` in scripts/qa/probe_long_text_index_contract_readonly.py:348", "shortDescription": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in scripts/qa/probe_long_text_index_contract_readonly.py:348"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80b5c0823585d098", "name": "Network/subprocess call without timeout or try/except \u2014 deploy/dev/property-catalog-docker/provision_0816d.py:145", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 deploy/dev/property-catalog-docker/provision_0816d.py:145"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-96416a7de68ccb98", "name": "Network/subprocess call without timeout or try/except \u2014 deploy/dev/property-catalog-docker/provision_existing_steady.py:", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 deploy/dev/property-catalog-docker/provision_existing_steady.py:47"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-42ac486b97224cb4", "name": "Legacy-named symbol `002_spans_v2` in e2e/scripts/e2e-coverage.test.mjs:88", "shortDescription": {"text": "Legacy-named symbol `002_spans_v2` in e2e/scripts/e2e-coverage.test.mjs:88"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdb6ca5f374fbcc0", "name": "494 env vars used in code but missing from .env.example", "shortDescription": {"text": "494 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENTCC_GATEWAY_URL`, `AGI_API_KEY`, `AIRBYTE_HOST`, `AIRBYTE_PORT`, `AI_PROVIDERS_ROUTE_MODE`, `ALK_DAYTONA_DOCKERFILE`, `ALK_HARNESS`, `ALK_HARNESS_MODEL` + 486 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\nfutureagi/agent_playground/serializers/node.py:519:validate_input_mappings, futureagi/agent_playground/serializers/node.py:572:validate_input_mappings\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\nfutureagi/model_hub/models/optimize_dataset.py:43:get_env_types, futureagi/model_hub/models/dataset_insight_meta.py:34:get_env_types, futureagi/model_hub/models/ai_model.py:91:get_env_types\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4bba556d36c70bc", "name": "Frontend route `/dashboard/observe/:observeId` has no Link/navigate to it \u2014 frontend/src/sections/projects/__tests__/Obs", "shortDescription": {"text": "Frontend route `/dashboard/observe/:observeId` has no Link/navigate to it \u2014 frontend/src/sections/projects/__tests__/ObservePage.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0b32afbe43fef08", "name": "Frontend route `/dataset/:dataset` has no Link/navigate to it \u2014 frontend/src/sections/develop-detail/Common/AddEvaluatio", "shortDescription": {"text": "Frontend route `/dataset/:dataset` has no Link/navigate to it \u2014 frontend/src/sections/develop-detail/Common/AddEvaluation/AddedEvaluationCard.stories.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49973ad80c1a8516", "name": "Frontend route `/dashboard/tasks/:taskId` has no Link/navigate to it \u2014 frontend/src/sections/tasks/__tests__/TaskDetailP", "shortDescription": {"text": "Frontend route `/dashboard/tasks/:taskId` has no Link/navigate to it \u2014 frontend/src/sections/tasks/__tests__/TaskDetailPage.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d9f9dacf4d75ef2", "name": "DRF view `AIFilterView` declares no `permission_classes` \u2014 futureagi/model_hub/views/ai_filter.py:1661", "shortDescription": {"text": "DRF view `AIFilterView` declares no `permission_classes` \u2014 futureagi/model_hub/views/ai_filter.py:1661"}, "fullDescription": {"text": "DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28896eb0b267dedc", "name": "DRF view `AsyncAPIView` declares no `permission_classes` \u2014 futureagi/simulate/views/livekit_api.py:149", "shortDescription": {"text": "DRF view `AsyncAPIView` declares no `permission_classes` \u2014 futureagi/simulate/views/livekit_api.py:149"}, "fullDescription": {"text": "DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-050f1bef1596d47a", "name": "Django CBV `CallConfigView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:229", "shortDescription": {"text": "Django CBV `CallConfigView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:229"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26120562f8ef1630", "name": "Django CBV `TranscriptsView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:250", "shortDescription": {"text": "Django CBV `TranscriptsView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:250"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c158713f4338274", "name": "Django CBV `PhoneResolutionView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:300", "shortDescription": {"text": "Django CBV `PhoneResolutionView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:300"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ed2addcc375c6aa", "name": "Django CBV `CallExecutionUpdateView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:321", "shortDescription": {"text": "Django CBV `CallExecutionUpdateView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:321"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25bb047ad80278dd", "name": "Django CBV `TemporalSignalView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:359", "shortDescription": {"text": "Django CBV `TemporalSignalView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:359"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-852a41153505753d", "name": "Django CBV `LiveKitWebhookView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:652", "shortDescription": {"text": "Django CBV `LiveKitWebhookView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:652"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-527478c759097300", "name": "Django CBV `CustomTokenObtainPairView` lacks `LoginRequiredMixin` \u2014 futureagi/accounts/views/user.py:136", "shortDescription": {"text": "Django CBV `CustomTokenObtainPairView` lacks `LoginRequiredMixin` \u2014 futureagi/accounts/views/user.py:136"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c6a624f05dd0b78", "name": "DRF view `HealthCheckView` declares no `permission_classes` \u2014 futureagi/tfc/views/health.py:17", "shortDescription": {"text": "DRF view `HealthCheckView` declares no `permission_classes` \u2014 futureagi/tfc/views/health.py:17"}, "fullDescription": {"text": "DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a7020516712d27e", "name": "DRF view `MCPOAuthAuthorizeView` declares no `permission_classes` \u2014 futureagi/mcp_server/views/oauth.py:91", "shortDescription": {"text": "DRF view `MCPOAuthAuthorizeView` declares no `permission_classes` \u2014 futureagi/mcp_server/views/oauth.py:91"}, "fullDescription": {"text": "DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e9c78bdd556400d6", "name": "FastAPI POST `infer` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:79", "shortDescription": {"text": "FastAPI POST `infer` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:79"}, "fullDescription": {"text": "`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-8821a53ad87b1be6", "name": "FastAPI POST `embed_text` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:190", "shortDescription": {"text": "FastAPI POST `embed_text` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:190"}, "fullDescription": {"text": "`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-b8374daad7ca750d", "name": "FastAPI POST `embed_image` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:213", "shortDescription": {"text": "FastAPI POST `embed_image` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:213"}, "fullDescription": {"text": "`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-7eb57cbfb544a453", "name": "FastAPI POST `embed_audio` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:236", "shortDescription": {"text": "FastAPI POST `embed_audio` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:236"}, "fullDescription": {"text": "`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-b3ea5aefee8e7b42", "name": "FastAPI POST `embed_image_text` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:259", "shortDescription": {"text": "FastAPI POST `embed_image_text` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:259"}, "fullDescription": {"text": "`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-7d20fe3dc5f19432", "name": "FastAPI POST `embed_syn_data` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:285", "shortDescription": {"text": "FastAPI POST `embed_syn_data` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:285"}, "fullDescription": {"text": "`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-0e840efe4ef10ac7", "name": "Django view `get_alias` may be unauthenticated \u2014 futureagi/saml2_auth/views.py:204", "shortDescription": {"text": "Django view `get_alias` may be unauthenticated \u2014 futureagi/saml2_auth/views.py:204"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ec6b93123da3b85", "name": "DRF view `ACSView` declares no `permission_classes` \u2014 futureagi/saml2_auth/views.py:218", "shortDescription": {"text": "DRF view `ACSView` declares no `permission_classes` \u2014 futureagi/saml2_auth/views.py:218"}, "fullDescription": {"text": "DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf795351de8316d4", "name": "Vulnerable dependency axios 1.5.1: GHSA-35jp-ww65-95wh", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-35jp-ww65-95wh"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-35jp-ww65-95wh (aka CVE-2026-44494).\n\naxios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`\n\nAliases: CVE-2026-44494\nAdvisory: https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e44952b5a90ac9d7", "name": "Vulnerable dependency axios 1.5.1: GHSA-3g43-6gmg-66jw", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-3g43-6gmg-66jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-3g43-6gmg-66jw (aka CVE-2026-44495).\n\naxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge\n\nAliases: CVE-2026-44495\nAdvisory: https://osv.dev/vulnerability/GHSA-3g43-6gmg-66jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14f33c733063f4c9", "name": "Vulnerable dependency axios 1.5.1: GHSA-3p68-rc4w-qgx5", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-3p68-rc4w-qgx5"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2c5b6f5d81b94f3", "name": "Vulnerable dependency axios 1.5.1: GHSA-3w6x-2g7m-8v23", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-3w6x-2g7m-8v23"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-3w6x-2g7m-8v23.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3w6x-2g7m-8v23\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf8b4d37df9d8c6b", "name": "Vulnerable dependency axios 1.5.1: GHSA-42h9-826w-cgv3", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-42h9-826w-cgv3"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-42h9-826w-cgv3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6453f1219a673e55", "name": "Vulnerable dependency axios 1.5.1: GHSA-43fc-jf86-j433", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-43fc-jf86-j433"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-43fc-jf86-j433.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-43fc-jf86-j433\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d74b0e86e43d8af", "name": "Vulnerable dependency axios 1.5.1: GHSA-445q-vr5w-6q77", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-445q-vr5w-6q77"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-445q-vr5w-6q77.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-445q-vr5w-6q77\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-402de9781b13084c", "name": "Vulnerable dependency axios 1.5.1: GHSA-4hjh-wcwx-xvwj", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-4hjh-wcwx-xvwj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-4hjh-wcwx-xvwj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4hjh-wcwx-xvwj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82d72752c94fa68a", "name": "Vulnerable dependency axios 1.5.1: GHSA-5c9x-8gcm-mpgx", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-5c9x-8gcm-mpgx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecd53d1bf869dfc0", "name": "Vulnerable dependency axios 1.5.1: GHSA-62hf-57xw-28j9", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-62hf-57xw-28j9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-62hf-57xw-28j9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe6f7a845b034030", "name": "Vulnerable dependency axios 1.5.1: GHSA-6chq-wfr3-2hj9", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-6chq-wfr3-2hj9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77133eb2f94be75b", "name": "Vulnerable dependency axios 1.5.1: GHSA-7q8q-rj6j-mhjq", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-7q8q-rj6j-mhjq"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4a94c3a92dea47a", "name": "Vulnerable dependency axios 1.5.1: GHSA-898c-q2cr-xwhg", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-898c-q2cr-xwhg"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-898c-q2cr-xwhg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b27a0210f29e588", "name": "Vulnerable dependency axios 1.5.1: GHSA-8hc4-vh64-cxmj", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-8hc4-vh64-cxmj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-8hc4-vh64-cxmj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8hc4-vh64-cxmj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e82906273812d16f", "name": "Vulnerable dependency axios 1.5.1: GHSA-fvcv-3m26-pcqx", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-fvcv-3m26-pcqx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9aedc6c93b062737", "name": "Vulnerable dependency axios 1.5.1: GHSA-hfxv-24rg-xrqf", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-hfxv-24rg-xrqf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e687085f0cef4b06", "name": "Vulnerable dependency axios 1.5.1: GHSA-j5f8-grm9-p9fc", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-j5f8-grm9-p9fc"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d007e7f4f427d35", "name": "Vulnerable dependency axios 1.5.1: GHSA-jr5f-v2jv-69x6", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-jr5f-v2jv-69x6"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eaec676fafa18e1f", "name": "Vulnerable dependency axios 1.5.1: GHSA-m7pr-hjqh-92cm", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-m7pr-hjqh-92cm"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6864905d949c9bd0", "name": "Vulnerable dependency axios 1.5.1: GHSA-mmx7-hfxf-jppx", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-mmx7-hfxf-jppx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf736d19777661eb", "name": "Vulnerable dependency axios 1.5.1: GHSA-p92q-9vqr-4j8v", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-p92q-9vqr-4j8v"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02f27dca13834ea7", "name": "Vulnerable dependency axios 1.5.1: GHSA-pf86-5x62-jrwf", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-pf86-5x62-jrwf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-pf86-5x62-jrwf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93d430f7930acd5f", "name": "Vulnerable dependency axios 1.5.1: GHSA-pmv8-rq9r-6j72", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-pmv8-rq9r-6j72"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-pmv8-rq9r-6j72.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ba333e0183d700e", "name": "Vulnerable dependency axios 1.5.1: GHSA-pmwg-cvhr-8vh7", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-pmwg-cvhr-8vh7"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-720469e5ed351f11", "name": "Vulnerable dependency axios 1.5.1: GHSA-q8qp-cvcw-x6jj", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-q8qp-cvcw-x6jj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-q8qp-cvcw-x6jj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8qp-cvcw-x6jj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-041b33e868eef10d", "name": "Vulnerable dependency axios 1.5.1: GHSA-vf2m-468p-8v99", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-vf2m-468p-8v99"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-vf2m-468p-8v99.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b2267bb56f0e12d", "name": "Vulnerable dependency axios 1.5.1: GHSA-w9j2-pvgh-6h63", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-w9j2-pvgh-6h63"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ede949d78ce5755", "name": "Vulnerable dependency axios 1.5.1: GHSA-wf5p-g6vw-rhxx", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-wf5p-g6vw-rhxx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-wf5p-g6vw-rhxx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8971c9333e028014", "name": "Vulnerable dependency axios 1.5.1: GHSA-xhjh-pmcv-23jw", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-xhjh-pmcv-23jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bb4f287996371a9", "name": "Vulnerable dependency axios 1.5.1: GHSA-xx6v-rp6x-q39c", "shortDescription": {"text": "Vulnerable dependency axios 1.5.1: GHSA-xx6v-rp6x-q39c"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.5.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b4fcd5417adde9a", "name": "Vulnerable dependency yaml 1.10.2: GHSA-48c2-rrv3-qjmp", "shortDescription": {"text": "Vulnerable dependency yaml 1.10.2: GHSA-48c2-rrv3-qjmp"}, "fullDescription": {"text": "OSV.dev reports `yaml` at version `1.10.2` (resolved in `frontend/package-lock.json`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532).\n\nyaml is vulnerable to Stack Overflow via deeply nested YAML collections\n\nAliases: CVE-2026-33532\nAdvisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp\nFix: upgrade `yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d0ca920a49dafed", "name": "Vulnerable dependency lodash 4.17.21: GHSA-f23m-r3pf-42rh", "shortDescription": {"text": "Vulnerable dependency lodash 4.17.21: GHSA-f23m-r3pf-42rh"}, "fullDescription": {"text": "OSV.dev reports `lodash` at version `4.17.21` (resolved in `frontend/package-lock.json`) is affected by GHSA-f23m-r3pf-42rh (aka CVE-2025-13465, CVE-2026-2950).\n\nlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`\n\nAliases: CVE-2025-13465, CVE-2026-2950, GHSA-xxjr-mmjv-4gpg\nAdvisory: https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh\nFix: upgrade `lodash` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-333a1d60caf8245d", "name": "Vulnerable dependency lodash 4.17.21: GHSA-r5fr-rjxr-66jc", "shortDescription": {"text": "Vulnerable dependency lodash 4.17.21: GHSA-r5fr-rjxr-66jc"}, "fullDescription": {"text": "OSV.dev reports `lodash` at version `4.17.21` (resolved in `frontend/package-lock.json`) is affected by GHSA-r5fr-rjxr-66jc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc\nFix: upgrade `lodash` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66a3e5a69e463139", "name": "Vulnerable dependency pdfjs-dist 3.11.174: GHSA-wgrm-67xf-hhpq", "shortDescription": {"text": "Vulnerable dependency pdfjs-dist 3.11.174: GHSA-wgrm-67xf-hhpq"}, "fullDescription": {"text": "OSV.dev reports `pdfjs-dist` at version `3.11.174` (resolved in `frontend/package-lock.json`) is affected by GHSA-wgrm-67xf-hhpq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wgrm-67xf-hhpq\nFix: upgrade `pdfjs-dist` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebf1ba408bccf060", "name": "Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25", "shortDescription": {"text": "Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25"}, "fullDescription": {"text": "OSV.dev reports `quill` at version `2.0.3` (resolved in `frontend/package-lock.json`) is affected by GHSA-v3m3-f69x-jf25.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v3m3-f69x-jf25\nFix: upgrade `quill` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d869c19d3ba10c0e", "name": "Vulnerable dependency quill 1.3.7: GHSA-4943-9vgg-gr5r", "shortDescription": {"text": "Vulnerable dependency quill 1.3.7: GHSA-4943-9vgg-gr5r"}, "fullDescription": {"text": "OSV.dev reports `quill` at version `1.3.7` (resolved in `frontend/package-lock.json`) is affected by GHSA-4943-9vgg-gr5r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4943-9vgg-gr5r\nFix: upgrade `quill` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-875544d9d6b0e344", "name": "Vulnerable dependency react-router 6.16.0: GHSA-2j2x-hqr9-3h42", "shortDescription": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-2j2x-hqr9-3h42"}, "fullDescription": {"text": "OSV.dev reports `react-router` at version `6.16.0` (resolved in `frontend/package-lock.json`) is affected by GHSA-2j2x-hqr9-3h42.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2j2x-hqr9-3h42\nFix: upgrade `react-router` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-599a4c9ceba98ad3", "name": "Vulnerable dependency react-router 6.16.0: GHSA-337j-9hxr-rhxg", "shortDescription": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-337j-9hxr-rhxg"}, "fullDescription": {"text": "OSV.dev reports `react-router` at version `6.16.0` (resolved in `frontend/package-lock.json`) is affected by GHSA-337j-9hxr-rhxg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-337j-9hxr-rhxg\nFix: upgrade `react-router` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f41a50e6ec22c01e", "name": "Vulnerable dependency react-router 6.16.0: GHSA-9jcx-v3wj-wh4m", "shortDescription": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-9jcx-v3wj-wh4m"}, "fullDescription": {"text": "OSV.dev reports `react-router` at version `6.16.0` (resolved in `frontend/package-lock.json`) is affected by GHSA-9jcx-v3wj-wh4m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9jcx-v3wj-wh4m\nFix: upgrade `react-router` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4fc3616bdd6c2d6", "name": "Vulnerable dependency react-router 6.16.0: GHSA-wrjc-x8rr-h8h6", "shortDescription": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-wrjc-x8rr-h8h6"}, "fullDescription": {"text": "OSV.dev reports `react-router` at version `6.16.0` (resolved in `frontend/package-lock.json`) is affected by GHSA-wrjc-x8rr-h8h6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wrjc-x8rr-h8h6\nFix: upgrade `react-router` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18759297e8882abd", "name": "Vulnerable dependency uuid 13.0.0: GHSA-w5hq-g745-h8pq", "shortDescription": {"text": "Vulnerable dependency uuid 13.0.0: GHSA-w5hq-g745-h8pq"}, "fullDescription": {"text": "OSV.dev reports `uuid` at version `13.0.0` (resolved in `frontend/package-lock.json`) is affected by GHSA-w5hq-g745-h8pq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq\nFix: upgrade `uuid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa0a35de74c801c6", "name": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `frontend/package-lock.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-39fd4869f48576c4", "name": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `frontend/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1e4b2ca1478f49f0", "name": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.21` (resolved in `frontend/package-lock.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2f77f20582517844", "name": "Vulnerable dependency vite 7.3.1: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 7.3.1: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.3.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-172958f0268d4a40", "name": "Vulnerable dependency vite 7.3.1: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 7.3.1: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.3.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1ebfbff855e30a64", "name": "Vulnerable dependency vite 7.3.1: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 7.3.1: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.3.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b3dc59ee817f1ae1", "name": "Vulnerable dependency vite 7.3.1: GHSA-v2wj-q39q-566r", "shortDescription": {"text": "Vulnerable dependency vite 7.3.1: GHSA-v2wj-q39q-566r"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.3.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-v2wj-q39q-566r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d0bfe31bbaf37ec9", "name": "Vulnerable dependency vite 7.3.1: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 7.3.1: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.3.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-83c5d3baceecefbf", "name": "Vulnerable dependency vitest 3.2.4: GHSA-5xrq-8626-4rwp", "shortDescription": {"text": "Vulnerable dependency vitest 3.2.4: GHSA-5xrq-8626-4rwp"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `3.2.4` (resolved in `frontend/package-lock.json`) is affected by GHSA-5xrq-8626-4rwp (aka CVE-2026-47429).\n\nWhen Vitest UI server is listening, arbitrary file can be read and executed\n\nAliases: CVE-2026-47429\nAdvisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d67d6666e482eed1", "name": "Vulnerable dependency vitest 3.2.4: GHSA-82fw-gwwq-j7x9", "shortDescription": {"text": "Vulnerable dependency vitest 3.2.4: GHSA-82fw-gwwq-j7x9"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `3.2.4` (resolved in `frontend/package-lock.json`) is affected by GHSA-82fw-gwwq-j7x9 (aka CVE-2026-84373).\n\nVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock\n\nAliases: CVE-2026-84373\nAdvisory: https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-40eaa96c2e817982", "name": "Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp", "shortDescription": {"text": "Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp"}, "fullDescription": {"text": "OSV.dev reports `yaml` at version `2.8.2` (resolved in `frontend/package-lock.json`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532).\n\nyaml is vulnerable to Stack Overflow via deeply nested YAML collections\n\nAliases: CVE-2026-33532\nAdvisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp\nFix: upgrade `yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d572baf8c7afebc", "name": "Vulnerable dependency diff 8.0.2: GHSA-73rr-hh4g-fpgx", "shortDescription": {"text": "Vulnerable dependency diff 8.0.2: GHSA-73rr-hh4g-fpgx"}, "fullDescription": {"text": "OSV.dev reports `diff` at version `8.0.2` (resolved in `frontend/yarn.lock`) is affected by GHSA-73rr-hh4g-fpgx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-73rr-hh4g-fpgx\nFix: upgrade `diff` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59fe3b6f6a42c1fd", "name": "Vulnerable dependency orval 8.9.1: GHSA-2h9g-j24r-h63g", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-2h9g-j24r-h63g"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-2h9g-j24r-h63g (aka CVE-2026-71869).\n\nOrval: Import-time RCE via array-items default -> zod module-level template literal\n\nAliases: CVE-2026-71869\nAdvisory: https://osv.dev/vulnerability/GHSA-2h9g-j24r-h63g\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8e4a82ffed0caf63", "name": "Vulnerable dependency orval 8.9.1: GHSA-2w86-xfrc-g85r", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-2w86-xfrc-g85r"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-2w86-xfrc-g85r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2w86-xfrc-g85r\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4da0886d9f7259f1", "name": "Vulnerable dependency orval 8.9.1: GHSA-3575-w9fc-c2j6", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-3575-w9fc-c2j6"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-3575-w9fc-c2j6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3575-w9fc-c2j6\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3e8b729402b92c0e", "name": "Vulnerable dependency orval 8.9.1: GHSA-6437-gxhq-pqv8", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-6437-gxhq-pqv8"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-6437-gxhq-pqv8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6437-gxhq-pqv8\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9f4e40d5510c9ce3", "name": "Vulnerable dependency orval 8.9.1: GHSA-653q-5476-x79g", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-653q-5476-x79g"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-653q-5476-x79g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-653q-5476-x79g\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b1e07975f5f576d6", "name": "Vulnerable dependency orval 8.9.1: GHSA-6mr6-jvcr-2f25", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-6mr6-jvcr-2f25"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-6mr6-jvcr-2f25.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6mr6-jvcr-2f25\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b8b96ec117d44bf5", "name": "Vulnerable dependency orval 8.9.1: GHSA-88f2-fpv8-89q2", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-88f2-fpv8-89q2"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-88f2-fpv8-89q2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-88f2-fpv8-89q2\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-72e2f317533fe7ae", "name": "Vulnerable dependency orval 8.9.1: GHSA-8j6p-r8jg-mxqh", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-8j6p-r8jg-mxqh"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-8j6p-r8jg-mxqh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8j6p-r8jg-mxqh\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2c83c75aeb0bc37f", "name": "Vulnerable dependency orval 8.9.1: GHSA-cxq5-97v7-87j8", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-cxq5-97v7-87j8"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-cxq5-97v7-87j8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cxq5-97v7-87j8\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7f82178b9e92fa31", "name": "Vulnerable dependency orval 8.9.1: GHSA-fg9p-mrxr-hvq7", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-fg9p-mrxr-hvq7"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-fg9p-mrxr-hvq7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fg9p-mrxr-hvq7\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8769d4522ba9696e", "name": "Vulnerable dependency orval 8.9.1: GHSA-p4cg-3328-rvfg", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-p4cg-3328-rvfg"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-p4cg-3328-rvfg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p4cg-3328-rvfg\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-722e96cd2a8abec2", "name": "Vulnerable dependency orval 8.9.1: GHSA-w727-8j6c-2rj4", "shortDescription": {"text": "Vulnerable dependency orval 8.9.1: GHSA-w727-8j6c-2rj4"}, "fullDescription": {"text": "OSV.dev reports `orval` at version `8.9.1` (resolved in `frontend/yarn.lock`) is affected by GHSA-w727-8j6c-2rj4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w727-8j6c-2rj4\nFix: upgrade `orval` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d905048c2808c242", "name": "Vulnerable dependency swiper 12.0.3: GHSA-hmx5-qpq5-p643", "shortDescription": {"text": "Vulnerable dependency swiper 12.0.3: GHSA-hmx5-qpq5-p643"}, "fullDescription": {"text": "OSV.dev reports `swiper` at version `12.0.3` (resolved in `frontend/yarn.lock`) is affected by GHSA-hmx5-qpq5-p643.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hmx5-qpq5-p643\nFix: upgrade `swiper` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30d7f1538da86253", "name": "Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-88519ae35c5cbb47", "name": "Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-93m4-6634-74q7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-93m4-6634-74q7\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-70ff31fd91e418d2", "name": "Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f08461cefacf5981", "name": "Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-g4jq-h2w9-997c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g4jq-h2w9-997c\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-119d393ba096329e", "name": "Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-jqfw-vq24-v9c3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jqfw-vq24-v9c3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-473721b30482b1c3", "name": "Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8c880e4bdced7e51", "name": "Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (resolved in `frontend/yarn.lock`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7cedc44a881c24c7", "name": "Vulnerable dependency vitest 3.2.3: GHSA-5xrq-8626-4rwp", "shortDescription": {"text": "Vulnerable dependency vitest 3.2.3: GHSA-5xrq-8626-4rwp"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `3.2.3` (resolved in `frontend/yarn.lock`) is affected by GHSA-5xrq-8626-4rwp (aka CVE-2026-47429).\n\nWhen Vitest UI server is listening, arbitrary file can be read and executed\n\nAliases: CVE-2026-47429\nAdvisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0efb5bbd3d4b7c4a", "name": "Vulnerable dependency vitest 3.2.3: GHSA-82fw-gwwq-j7x9", "shortDescription": {"text": "Vulnerable dependency vitest 3.2.3: GHSA-82fw-gwwq-j7x9"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `3.2.3` (resolved in `frontend/yarn.lock`) is affected by GHSA-82fw-gwwq-j7x9 (aka CVE-2026-84373).\n\nVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock\n\nAliases: CVE-2026-84373\nAdvisory: https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8b03368702ccf527", "name": "Vulnerable dependency yaml 2.8.0: GHSA-48c2-rrv3-qjmp", "shortDescription": {"text": "Vulnerable dependency yaml 2.8.0: GHSA-48c2-rrv3-qjmp"}, "fullDescription": {"text": "OSV.dev reports `yaml` at version `2.8.0` (resolved in `frontend/yarn.lock`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532).\n\nyaml is vulnerable to Stack Overflow via deeply nested YAML collections\n\nAliases: CVE-2026-33532\nAdvisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp\nFix: upgrade `yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2ea1200dc42372a", "name": "Vulnerable dependency anyio 4.12.1: GHSA-5p39-cfhj-2xmp", "shortDescription": {"text": "Vulnerable dependency anyio 4.12.1: GHSA-5p39-cfhj-2xmp"}, "fullDescription": {"text": "OSV.dev reports `anyio` at version `4.12.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-5p39-cfhj-2xmp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5p39-cfhj-2xmp\nFix: upgrade `anyio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8608d866f1da5328", "name": "Vulnerable dependency anyio 4.12.1: GHSA-82r6-8w77-94w6", "shortDescription": {"text": "Vulnerable dependency anyio 4.12.1: GHSA-82r6-8w77-94w6"}, "fullDescription": {"text": "OSV.dev reports `anyio` at version `4.12.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-82r6-8w77-94w6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-82r6-8w77-94w6\nFix: upgrade `anyio` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e863fe78861504ae", "name": "Vulnerable dependency authlib 1.6.6: GHSA-7432-952r-cw78", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-7432-952r-cw78"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-7432-952r-cw78.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7432-952r-cw78\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76455d35f1bf7907", "name": "Vulnerable dependency authlib 1.6.6: GHSA-7wc2-qxgw-g8gg", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-7wc2-qxgw-g8gg"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-7wc2-qxgw-g8gg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7wc2-qxgw-g8gg\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27713ce10260788e", "name": "Vulnerable dependency authlib 1.6.6: GHSA-jj8c-mmj3-mmgv", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-jj8c-mmj3-mmgv"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-jj8c-mmj3-mmgv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jj8c-mmj3-mmgv\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca0170f658ff97f6", "name": "Vulnerable dependency authlib 1.6.6: GHSA-m344-f55w-2m6j", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-m344-f55w-2m6j"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-m344-f55w-2m6j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m344-f55w-2m6j\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5899ed92cd9b2cc1", "name": "Vulnerable dependency authlib 1.6.6: GHSA-r95x-qfjj-fjj2", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-r95x-qfjj-fjj2"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-r95x-qfjj-fjj2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r95x-qfjj-fjj2\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecfae77eead2c00d", "name": "Vulnerable dependency authlib 1.6.6: GHSA-w8p2-r796-3vmq", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-w8p2-r796-3vmq"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-w8p2-r796-3vmq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w8p2-r796-3vmq\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b3378b380456fa2", "name": "Vulnerable dependency authlib 1.6.6: GHSA-wvwj-cvrp-7pv5", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-wvwj-cvrp-7pv5"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by GHSA-wvwj-cvrp-7pv5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wvwj-cvrp-7pv5\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c109ed9c5a2c03b4", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-188", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-188"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-188.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-188\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6042d02e70a94ee6", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2116", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2116"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2116.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2116\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de86bc708a166525", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2117", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2117"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2117.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2117\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16ce6b3a4d59b645", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2118", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2118"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2118.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2118\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec9b20a639737459", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2119", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2119"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2119.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2119\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8da3065f8b6a5d57", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-25", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-25"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-25.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-25\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c16cd705cad25385", "name": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-287", "shortDescription": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-287"}, "fullDescription": {"text": "OSV.dev reports `authlib` at version `1.6.6` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-287.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-287\nFix: upgrade `authlib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efcadeb417bd31cd", "name": "Vulnerable dependency cbor2 5.8.0: GHSA-3c37-wwvx-h642", "shortDescription": {"text": "Vulnerable dependency cbor2 5.8.0: GHSA-3c37-wwvx-h642"}, "fullDescription": {"text": "OSV.dev reports `cbor2` at version `5.8.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-3c37-wwvx-h642.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3c37-wwvx-h642\nFix: upgrade `cbor2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc7605893f7c9ef4", "name": "Vulnerable dependency cbor2 5.8.0: PYSEC-2026-2123", "shortDescription": {"text": "Vulnerable dependency cbor2 5.8.0: PYSEC-2026-2123"}, "fullDescription": {"text": "OSV.dev reports `cbor2` at version `5.8.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2123.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2123\nFix: upgrade `cbor2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e478839f26ffd88", "name": "Vulnerable dependency chromadb 1.5.5: GHSA-2wm9-hf6c-p5cr", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-2wm9-hf6c-p5cr"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-2wm9-hf6c-p5cr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2wm9-hf6c-p5cr\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-678ab084567ec5a2", "name": "Vulnerable dependency chromadb 1.5.5: GHSA-36p7-vc44-83pf", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-36p7-vc44-83pf"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-36p7-vc44-83pf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-36p7-vc44-83pf\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-255aa05b8e8f6b85", "name": "Vulnerable dependency chromadb 1.5.5: GHSA-f4j7-r4q5-qw2c", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-f4j7-r4q5-qw2c"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-f4j7-r4q5-qw2c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f4j7-r4q5-qw2c\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c3d2a46034e3c48", "name": "Vulnerable dependency chromadb 1.5.5: GHSA-xph7-9rjv-w5fr", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-xph7-9rjv-w5fr"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-xph7-9rjv-w5fr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xph7-9rjv-w5fr\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d93776cb1417946d", "name": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-311", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-311"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-311.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-311\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-866f9773be58f40d", "name": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3813", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3813"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3813.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3813\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98d2af2be2c7c0fb", "name": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3814", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3814"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3814.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3814\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-402fc07a1908eeea", "name": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3815", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3815"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3815.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3815\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc5b28292b32ab72", "name": "Vulnerable dependency click 8.3.1: PYSEC-2026-2132", "shortDescription": {"text": "Vulnerable dependency click 8.3.1: PYSEC-2026-2132"}, "fullDescription": {"text": "OSV.dev reports `click` at version `8.3.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2132.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2132\nFix: upgrade `click` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a424d684507cc6f6", "name": "Vulnerable dependency cryptography 46.0.5: GHSA-537c-gmf6-5ccf", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-537c-gmf6-5ccf"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-537c-gmf6-5ccf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb7b891a057ab2a1", "name": "Vulnerable dependency cryptography 46.0.5: GHSA-g6cj-pr64-35w5", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-g6cj-pr64-35w5"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-g6cj-pr64-35w5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g6cj-pr64-35w5\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6663d86673f3179c", "name": "Vulnerable dependency cryptography 46.0.5: GHSA-jwv3-5hgf-82ww", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-jwv3-5hgf-82ww"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-jwv3-5hgf-82ww.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jwv3-5hgf-82ww\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16a4fec265d6dc32", "name": "Vulnerable dependency cryptography 46.0.5: GHSA-m2h6-j472-rp4c", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-m2h6-j472-rp4c"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-m2h6-j472-rp4c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m2h6-j472-rp4c\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3e92d58081c05f7", "name": "Vulnerable dependency cryptography 46.0.5: GHSA-m959-cc7f-wv43", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-m959-cc7f-wv43"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-m959-cc7f-wv43.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m959-cc7f-wv43\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68d1bf30b6aef8d1", "name": "Vulnerable dependency cryptography 46.0.5: GHSA-p423-j2cm-9vmq", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-p423-j2cm-9vmq"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-p423-j2cm-9vmq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p423-j2cm-9vmq\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bce077408386b4b0", "name": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-35", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-35"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-35.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-35\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e7f97d0cb4bd799", "name": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3552", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3552"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3552.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3552\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe78358c1050a360", "name": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3553", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3553"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3553.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3553\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3ceae6aa0150409", "name": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3554", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3554"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3554.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3554\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-238ab6293a0a1fa2", "name": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-36", "shortDescription": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-36"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `46.0.5` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-36.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-36\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb7836d22a4800f7", "name": "Vulnerable dependency datasets 4.5.0: PYSEC-2026-3716", "shortDescription": {"text": "Vulnerable dependency datasets 4.5.0: PYSEC-2026-3716"}, "fullDescription": {"text": "OSV.dev reports `datasets` at version `4.5.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3716.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3716\nFix: upgrade `datasets` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d1c450675a10f57", "name": "Vulnerable dependency django 5.1.8: GHSA-3h9f-r86x-qvjx", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-3h9f-r86x-qvjx"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-3h9f-r86x-qvjx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3h9f-r86x-qvjx\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4085a017925e31c5", "name": "Vulnerable dependency django 5.1.8: GHSA-6w2r-r2m5-xq5w", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-6w2r-r2m5-xq5w"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-6w2r-r2m5-xq5w.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6w2r-r2m5-xq5w\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fe071f1afd98aca", "name": "Vulnerable dependency django 5.1.8: GHSA-7xr5-9hcq-chf9", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-7xr5-9hcq-chf9"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-7xr5-9hcq-chf9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7xr5-9hcq-chf9\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8380acdc8c6edbe", "name": "Vulnerable dependency django 5.1.8: GHSA-8cjm-8mp7-r2xf", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-8cjm-8mp7-r2xf"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-8cjm-8mp7-r2xf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8cjm-8mp7-r2xf\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec75bddfad27cf65", "name": "Vulnerable dependency django 5.1.8: GHSA-8j24-cjrq-gr2m", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-8j24-cjrq-gr2m"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-8j24-cjrq-gr2m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8j24-cjrq-gr2m\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cce83aa9dcf4200b", "name": "Vulnerable dependency django 5.1.8: GHSA-8qcx-xf44-272x", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-8qcx-xf44-272x"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-8qcx-xf44-272x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8qcx-xf44-272x\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-366eb04e56638a98", "name": "Vulnerable dependency django 5.1.8: GHSA-923m-gv2p-w5qp", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-923m-gv2p-w5qp"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-923m-gv2p-w5qp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-923m-gv2p-w5qp\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c5180fd1bc1e598", "name": "Vulnerable dependency django 5.1.8: GHSA-crhf-3pfg-w68w", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-crhf-3pfg-w68w"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-crhf-3pfg-w68w.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-crhf-3pfg-w68w\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4dc4e20b47667cd", "name": "Vulnerable dependency django 5.1.8: GHSA-frmv-pr5f-9mcr", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-frmv-pr5f-9mcr"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-frmv-pr5f-9mcr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-frmv-pr5f-9mcr\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab6605aa93ac88cb", "name": "Vulnerable dependency django 5.1.8: GHSA-h7pc-vwp9-298g", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-h7pc-vwp9-298g"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-h7pc-vwp9-298g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h7pc-vwp9-298g\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fa8ca9ddd2cfb60", "name": "Vulnerable dependency django 5.1.8: GHSA-hpr9-3m2g-3j9p", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-hpr9-3m2g-3j9p"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-hpr9-3m2g-3j9p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hpr9-3m2g-3j9p\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bd1aebbae6cd1a4", "name": "Vulnerable dependency django 5.1.8: GHSA-q95w-c7qg-hrff", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-q95w-c7qg-hrff"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-q95w-c7qg-hrff.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q95w-c7qg-hrff\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d673e9d136f7b0a6", "name": "Vulnerable dependency django 5.1.8: GHSA-qw25-v68c-qjf3", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-qw25-v68c-qjf3"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-qw25-v68c-qjf3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qw25-v68c-qjf3\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac1904e3dd2f82a9", "name": "Vulnerable dependency django 5.1.8: GHSA-rqw2-ghq9-44m7", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-rqw2-ghq9-44m7"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-rqw2-ghq9-44m7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rqw2-ghq9-44m7\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-313d9add591eff63", "name": "Vulnerable dependency django 5.1.8: GHSA-vrcr-9hj9-jcg6", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: GHSA-vrcr-9hj9-jcg6"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by GHSA-vrcr-9hj9-jcg6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vrcr-9hj9-jcg6\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25c199d6f9b78f0c", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-104", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-104"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-104.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-104\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9da8aa8ac656b1c3", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-105", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-105"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-105.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-105\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b877cf8414cb36e7", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-106", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-106"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-106.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-106\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9313d37391201aee", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-107", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-107"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-107.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-107\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bafaf767ef69aa37", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-108", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-108"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-108.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-108\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-601fba396b4fbdf2", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-109", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-109"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-109.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-109\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2eb31cc9fdce344", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-37", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-37"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-37.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-37\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d7815b63793e15a", "name": "Vulnerable dependency django 5.1.8: PYSEC-2025-47", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-47"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-47.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-47\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2333dd2863447297", "name": "Vulnerable dependency django 5.1.8: PYSEC-2026-1296", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2026-1296"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1296.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1296\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d17bef3eece3aa1", "name": "Vulnerable dependency django 5.1.8: PYSEC-2026-3717", "shortDescription": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2026-3717"}, "fullDescription": {"text": "OSV.dev reports `django` at version `5.1.8` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3717.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3717\nFix: upgrade `django` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea33d166d39df4d0", "name": "Vulnerable dependency djangorestframework 3.16.1: GHSA-2m8g-3cmr-wg3w", "shortDescription": {"text": "Vulnerable dependency djangorestframework 3.16.1: GHSA-2m8g-3cmr-wg3w"}, "fullDescription": {"text": "OSV.dev reports `djangorestframework` at version `3.16.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-2m8g-3cmr-wg3w.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2m8g-3cmr-wg3w\nFix: upgrade `djangorestframework` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b048def1967efc88", "name": "Vulnerable dependency djangorestframework 3.16.1: GHSA-g47c-3xmw-q6m2", "shortDescription": {"text": "Vulnerable dependency djangorestframework 3.16.1: GHSA-g47c-3xmw-q6m2"}, "fullDescription": {"text": "OSV.dev reports `djangorestframework` at version `3.16.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-g47c-3xmw-q6m2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g47c-3xmw-q6m2\nFix: upgrade `djangorestframework` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-580aefbb35e777a3", "name": "Vulnerable dependency djangorestframework 3.16.1: PYSEC-2026-3827", "shortDescription": {"text": "Vulnerable dependency djangorestframework 3.16.1: PYSEC-2026-3827"}, "fullDescription": {"text": "OSV.dev reports `djangorestframework` at version `3.16.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3827.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3827\nFix: upgrade `djangorestframework` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7120e473ddda950", "name": "Vulnerable dependency djangorestframework 3.16.1: PYSEC-2026-3828", "shortDescription": {"text": "Vulnerable dependency djangorestframework 3.16.1: PYSEC-2026-3828"}, "fullDescription": {"text": "OSV.dev reports `djangorestframework` at version `3.16.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3828.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3828\nFix: upgrade `djangorestframework` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47ac4376d113364b", "name": "Vulnerable dependency ecdsa 0.19.1: GHSA-9f5j-8jwj-x28g", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-9f5j-8jwj-x28g"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-9f5j-8jwj-x28g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9f5j-8jwj-x28g\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61293a37b345ad68", "name": "Vulnerable dependency ecdsa 0.19.1: GHSA-wj6h-64fc-37mp", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-wj6h-64fc-37mp"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-wj6h-64fc-37mp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wj6h-64fc-37mp\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e221a07e02838af8", "name": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-1325", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-1325"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1325.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1325\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-266906c069d9b55a", "name": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-2467", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-2467"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2467.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2467\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf1386208c90609e", "name": "Vulnerable dependency granian 2.6.1: GHSA-f5p7-9fr5-8jmj", "shortDescription": {"text": "Vulnerable dependency granian 2.6.1: GHSA-f5p7-9fr5-8jmj"}, "fullDescription": {"text": "OSV.dev reports `granian` at version `2.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-f5p7-9fr5-8jmj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f5p7-9fr5-8jmj\nFix: upgrade `granian` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c297730604be27ab", "name": "Vulnerable dependency granian 2.6.1: GHSA-vrg7-482j-p6f6", "shortDescription": {"text": "Vulnerable dependency granian 2.6.1: GHSA-vrg7-482j-p6f6"}, "fullDescription": {"text": "OSV.dev reports `granian` at version `2.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-vrg7-482j-p6f6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vrg7-482j-p6f6\nFix: upgrade `granian` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3994b99817b904c", "name": "Vulnerable dependency granian 2.6.1: PYSEC-2026-2502", "shortDescription": {"text": "Vulnerable dependency granian 2.6.1: PYSEC-2026-2502"}, "fullDescription": {"text": "OSV.dev reports `granian` at version `2.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2502.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2502\nFix: upgrade `granian` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c05271357dfbb89", "name": "Vulnerable dependency granian 2.6.1: PYSEC-2026-2503", "shortDescription": {"text": "Vulnerable dependency granian 2.6.1: PYSEC-2026-2503"}, "fullDescription": {"text": "OSV.dev reports `granian` at version `2.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2503.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2503\nFix: upgrade `granian` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-568a970c74e3d57f", "name": "Vulnerable dependency h2 4.3.0: GHSA-6hr6-w5qg-qmwg", "shortDescription": {"text": "Vulnerable dependency h2 4.3.0: GHSA-6hr6-w5qg-qmwg"}, "fullDescription": {"text": "OSV.dev reports `h2` at version `4.3.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-6hr6-w5qg-qmwg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6hr6-w5qg-qmwg\nFix: upgrade `h2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2852c8e8158a0ddb", "name": "Vulnerable dependency h2 4.3.0: PYSEC-2026-3628", "shortDescription": {"text": "Vulnerable dependency h2 4.3.0: PYSEC-2026-3628"}, "fullDescription": {"text": "OSV.dev reports `h2` at version `4.3.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3628.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3628\nFix: upgrade `h2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19f24560e2ed778e", "name": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx", "shortDescription": {"text": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx"}, "fullDescription": {"text": "OSV.dev reports `idna` at version `3.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-65pc-fj4g-8rjx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx\nFix: upgrade `idna` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67fa3cbc85b501c4", "name": "Vulnerable dependency idna 3.11: PYSEC-2026-215", "shortDescription": {"text": "Vulnerable dependency idna 3.11: PYSEC-2026-215"}, "fullDescription": {"text": "OSV.dev reports `idna` at version `3.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-215.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-215\nFix: upgrade `idna` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cfea5c42ae464abb", "name": "Vulnerable dependency json-repair 0.55.0: GHSA-xf7x-x43h-rpqh", "shortDescription": {"text": "Vulnerable dependency json-repair 0.55.0: GHSA-xf7x-x43h-rpqh"}, "fullDescription": {"text": "OSV.dev reports `json-repair` at version `0.55.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-xf7x-x43h-rpqh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xf7x-x43h-rpqh\nFix: upgrade `json-repair` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4982964d7c9a9b6f", "name": "Vulnerable dependency langchain 0.3.27: GHSA-3644-q5cj-c5c7", "shortDescription": {"text": "Vulnerable dependency langchain 0.3.27: GHSA-3644-q5cj-c5c7"}, "fullDescription": {"text": "OSV.dev reports `langchain` at version `0.3.27` (resolved in `futureagi/uv.lock`) is affected by GHSA-3644-q5cj-c5c7 (aka CVE-2026-45134).\n\nLangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning\n\nAliases: CVE-2026-45134, PYSEC-2026-2555, PYSEC-2026-2560, PYSEC-2026-2582\nAdvisory: https://osv.dev/vulnerability/GHSA-3644-q5cj-c5c7\nFix: upgrade `langchain` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-607cc7cc56e156c8", "name": "Vulnerable dependency langchain 0.3.27: GHSA-gr75-jv2w-4656", "shortDescription": {"text": "Vulnerable dependency langchain 0.3.27: GHSA-gr75-jv2w-4656"}, "fullDescription": {"text": "OSV.dev reports `langchain` at version `0.3.27` (resolved in `futureagi/uv.lock`) is affected by GHSA-gr75-jv2w-4656.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gr75-jv2w-4656\nFix: upgrade `langchain` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6978204b51035df2", "name": "Vulnerable dependency langchain 0.3.27: PYSEC-2026-2192", "shortDescription": {"text": "Vulnerable dependency langchain 0.3.27: PYSEC-2026-2192"}, "fullDescription": {"text": "OSV.dev reports `langchain` at version `0.3.27` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2192.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2192\nFix: upgrade `langchain` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77e84adba9852df7", "name": "Vulnerable dependency langchain-core 0.3.83: GHSA-2g6r-c272-w58r", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-2g6r-c272-w58r"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by GHSA-2g6r-c272-w58r (aka CVE-2026-26013).\n\nLangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages\n\nAliases: CVE-2026-26013, PYSEC-2026-2562\nAdvisory: https://osv.dev/vulnerability/GHSA-2g6r-c272-w58r\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-064c062d417bdcc0", "name": "Vulnerable dependency langchain-core 0.3.83: GHSA-926x-3r5x-gfhw", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-926x-3r5x-gfhw"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by GHSA-926x-3r5x-gfhw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-926x-3r5x-gfhw\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62366c73bed00a1c", "name": "Vulnerable dependency langchain-core 0.3.83: GHSA-pjwx-r37v-7724", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-pjwx-r37v-7724"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by GHSA-pjwx-r37v-7724.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pjwx-r37v-7724\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53ec90f7df1402a1", "name": "Vulnerable dependency langchain-core 0.3.83: GHSA-qh6h-p6c9-ff54", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-qh6h-p6c9-ff54"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by GHSA-qh6h-p6c9-ff54.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qh6h-p6c9-ff54\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6619ff5dda31268", "name": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2193", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2193"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2193.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2193\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9d01713cea3d630", "name": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2563", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2563"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2563.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2563\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0dcf3ee72ef690db", "name": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2564", "shortDescription": {"text": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2564"}, "fullDescription": {"text": "OSV.dev reports `langchain-core` at version `0.3.83` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2564.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2564\nFix: upgrade `langchain-core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a698457206fe066", "name": "Vulnerable dependency langchain-text-splitters 0.3.11: GHSA-fv5p-p927-qmxr", "shortDescription": {"text": "Vulnerable dependency langchain-text-splitters 0.3.11: GHSA-fv5p-p927-qmxr"}, "fullDescription": {"text": "OSV.dev reports `langchain-text-splitters` at version `0.3.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-fv5p-p927-qmxr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fv5p-p927-qmxr\nFix: upgrade `langchain-text-splitters` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1af9cfef6024f94a", "name": "Vulnerable dependency langchain-text-splitters 0.3.11: PYSEC-2026-77", "shortDescription": {"text": "Vulnerable dependency langchain-text-splitters 0.3.11: PYSEC-2026-77"}, "fullDescription": {"text": "OSV.dev reports `langchain-text-splitters` at version `0.3.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-77.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-77\nFix: upgrade `langchain-text-splitters` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-230809427914f14a", "name": "Vulnerable dependency langsmith 0.6.3: GHSA-3644-q5cj-c5c7", "shortDescription": {"text": "Vulnerable dependency langsmith 0.6.3: GHSA-3644-q5cj-c5c7"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.6.3` (resolved in `futureagi/uv.lock`) is affected by GHSA-3644-q5cj-c5c7 (aka CVE-2026-45134).\n\nLangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning\n\nAliases: CVE-2026-45134, PYSEC-2026-2555, PYSEC-2026-2560, PYSEC-2026-2582\nAdvisory: https://osv.dev/vulnerability/GHSA-3644-q5cj-c5c7\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e215dee1005bbe18", "name": "Vulnerable dependency langsmith 0.6.3: GHSA-f4xh-w4cj-qxq8", "shortDescription": {"text": "Vulnerable dependency langsmith 0.6.3: GHSA-f4xh-w4cj-qxq8"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.6.3` (resolved in `futureagi/uv.lock`) is affected by GHSA-f4xh-w4cj-qxq8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f4xh-w4cj-qxq8\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5dc30cf304f450de", "name": "Vulnerable dependency langsmith 0.6.3: GHSA-rr7j-v2q5-chgv", "shortDescription": {"text": "Vulnerable dependency langsmith 0.6.3: GHSA-rr7j-v2q5-chgv"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.6.3` (resolved in `futureagi/uv.lock`) is affected by GHSA-rr7j-v2q5-chgv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rr7j-v2q5-chgv\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0281fa4a6697b10d", "name": "Vulnerable dependency langsmith 0.6.3: PYSEC-2026-2583", "shortDescription": {"text": "Vulnerable dependency langsmith 0.6.3: PYSEC-2026-2583"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.6.3` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2583.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2583\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8b3edb6c6bc5941", "name": "Vulnerable dependency litellm 1.81.11: GHSA-4g5m-c9r5-49xf", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-4g5m-c9r5-49xf"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-4g5m-c9r5-49xf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4g5m-c9r5-49xf\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90256721ba383958", "name": "Vulnerable dependency litellm 1.81.11: GHSA-4jcj-7x88-m979", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-4jcj-7x88-m979"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-4jcj-7x88-m979.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4jcj-7x88-m979\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0e86f65d4efe6b8", "name": "Vulnerable dependency litellm 1.81.11: GHSA-4xpc-pv4p-pm3w", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-4xpc-pv4p-pm3w"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-4xpc-pv4p-pm3w.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4xpc-pv4p-pm3w\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08239e1b4773558c", "name": "Vulnerable dependency litellm 1.81.11: GHSA-53mr-6c8q-9789", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-53mr-6c8q-9789"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-53mr-6c8q-9789.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-53mr-6c8q-9789\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a764c14709b66e8f", "name": "Vulnerable dependency litellm 1.81.11: GHSA-5jmr-gcrj-2c9q", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-5jmr-gcrj-2c9q"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-5jmr-gcrj-2c9q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5jmr-gcrj-2c9q\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cddc1ec0c76a184", "name": "Vulnerable dependency litellm 1.81.11: GHSA-69x8-hrgq-fjj8", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-69x8-hrgq-fjj8"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-69x8-hrgq-fjj8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-69x8-hrgq-fjj8\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae550fda9ed7f87c", "name": "Vulnerable dependency litellm 1.81.11: GHSA-6wvf-77m9-58rm", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-6wvf-77m9-58rm"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-6wvf-77m9-58rm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6wvf-77m9-58rm\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e5e8f0f156c52ee", "name": "Vulnerable dependency litellm 1.81.11: GHSA-72m8-9m7m-h278", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-72m8-9m7m-h278"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-72m8-9m7m-h278.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-72m8-9m7m-h278\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da31848e7d664e3b", "name": "Vulnerable dependency litellm 1.81.11: GHSA-7488-6r32-c95q", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-7488-6r32-c95q"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-7488-6r32-c95q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7488-6r32-c95q\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48db989c05caad7f", "name": "Vulnerable dependency litellm 1.81.11: GHSA-c693-x898-5g4h", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-c693-x898-5g4h"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-c693-x898-5g4h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c693-x898-5g4h\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7a76c57f9847f31", "name": "Vulnerable dependency litellm 1.81.11: GHSA-hx8v-g79f-8w5f", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-hx8v-g79f-8w5f"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-hx8v-g79f-8w5f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hx8v-g79f-8w5f\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5fe9604c4782094", "name": "Vulnerable dependency litellm 1.81.11: GHSA-j37q-q7p9-vpwm", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-j37q-q7p9-vpwm"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-j37q-q7p9-vpwm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j37q-q7p9-vpwm\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d88837eb870ae8e", "name": "Vulnerable dependency litellm 1.81.11: GHSA-jjhc-v7c2-5hh6", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-jjhc-v7c2-5hh6"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-jjhc-v7c2-5hh6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jjhc-v7c2-5hh6\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02b9f7a84ccafed6", "name": "Vulnerable dependency litellm 1.81.11: GHSA-m2v5-74w2-qhcj", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-m2v5-74w2-qhcj"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-m2v5-74w2-qhcj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m2v5-74w2-qhcj\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-690380538513fa56", "name": "Vulnerable dependency litellm 1.81.11: GHSA-mf52-j94g-746m", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-mf52-j94g-746m"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-mf52-j94g-746m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mf52-j94g-746m\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-476f71eb96dd30a1", "name": "Vulnerable dependency litellm 1.81.11: GHSA-p897-vf7j-f5h8", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-p897-vf7j-f5h8"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-p897-vf7j-f5h8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p897-vf7j-f5h8\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f0d8b2214b27ab3", "name": "Vulnerable dependency litellm 1.81.11: GHSA-qmf3-4767-5fg3", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-qmf3-4767-5fg3"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-qmf3-4767-5fg3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qmf3-4767-5fg3\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12551f42e7194192", "name": "Vulnerable dependency litellm 1.81.11: GHSA-qrc4-49gv-mv9m", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-qrc4-49gv-mv9m"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-qrc4-49gv-mv9m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qrc4-49gv-mv9m\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b94e35d9acc800b", "name": "Vulnerable dependency litellm 1.81.11: GHSA-v4p8-mg3p-g94g", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-v4p8-mg3p-g94g"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-v4p8-mg3p-g94g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v4p8-mg3p-g94g\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a300d2d0af7f809", "name": "Vulnerable dependency litellm 1.81.11: GHSA-w2mh-qq9q-453x", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-w2mh-qq9q-453x"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-w2mh-qq9q-453x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w2mh-qq9q-453x\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd08376d9961d535", "name": "Vulnerable dependency litellm 1.81.11: GHSA-wpfp-gwwc-vwq6", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-wpfp-gwwc-vwq6"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-wpfp-gwwc-vwq6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wpfp-gwwc-vwq6\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4478b3b8798be3a8", "name": "Vulnerable dependency litellm 1.81.11: GHSA-wxxx-gvqv-xp7p", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-wxxx-gvqv-xp7p"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-wxxx-gvqv-xp7p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wxxx-gvqv-xp7p\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff51d131c412be8f", "name": "Vulnerable dependency litellm 1.81.11: GHSA-xqmj-j6mv-4862", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-xqmj-j6mv-4862"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by GHSA-xqmj-j6mv-4862.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xqmj-j6mv-4862\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b778fe8e888e95ea", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2597", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2597"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2597.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2597\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a70f0372f242e38d", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2598", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2598"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2598.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2598\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe98d42f900cf179", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2599", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2599"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2599.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2599\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07a5d7eb3c8a1d8f", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2600", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2600"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2600.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2600\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cfa467d59a6ceac3", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2601", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2601"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2601.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2601\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41c4d6c149a31e2d", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2602", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2602"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2602.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2602\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4888092397845aab", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3476", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3476"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3476.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3476\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-def444df5ecd395d", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3477", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3477"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3477.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3477\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-152f1d392d2d05e8", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3478", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3478"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3478.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3478\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5979a23d310b5dae", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3479", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3479"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3479.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3479\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee750379a844b92f", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3861", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3861"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3861.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3861\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b99bf6ec8fb65df", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-388", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-388"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-388.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-388\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b948936725b4d7cc", "name": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-390", "shortDescription": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-390"}, "fullDescription": {"text": "OSV.dev reports `litellm` at version `1.81.11` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-390.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-390\nFix: upgrade `litellm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01ec0d7c96c39e03", "name": "Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw", "shortDescription": {"text": "Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw"}, "fullDescription": {"text": "OSV.dev reports `lxml` at version `6.0.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-vfmq-68hx-4jfw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfmq-68hx-4jfw\nFix: upgrade `lxml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54c5acac7af14333", "name": "Vulnerable dependency lxml 6.0.2: PYSEC-2026-87", "shortDescription": {"text": "Vulnerable dependency lxml 6.0.2: PYSEC-2026-87"}, "fullDescription": {"text": "OSV.dev reports `lxml` at version `6.0.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-87.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-87\nFix: upgrade `lxml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a61d3afafcb77fd", "name": "Vulnerable dependency mako 1.3.10: GHSA-2h4p-vjrc-8xpq", "shortDescription": {"text": "Vulnerable dependency mako 1.3.10: GHSA-2h4p-vjrc-8xpq"}, "fullDescription": {"text": "OSV.dev reports `mako` at version `1.3.10` (resolved in `futureagi/uv.lock`) is affected by GHSA-2h4p-vjrc-8xpq (aka CVE-2026-44307).\n\nMako vulnerable to path traversal via backslash URI on Windows in TemplateLookup\n\nAliases: CVE-2026-44307, PYSEC-2026-2617\nAdvisory: https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq\nFix: upgrade `mako` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d11a2dd46069dad", "name": "Vulnerable dependency mako 1.3.10: GHSA-v92g-xgxw-vvmm", "shortDescription": {"text": "Vulnerable dependency mako 1.3.10: GHSA-v92g-xgxw-vvmm"}, "fullDescription": {"text": "OSV.dev reports `mako` at version `1.3.10` (resolved in `futureagi/uv.lock`) is affected by GHSA-v92g-xgxw-vvmm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm\nFix: upgrade `mako` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87f353c24cbb68d6", "name": "Vulnerable dependency mako 1.3.10: PYSEC-2026-88", "shortDescription": {"text": "Vulnerable dependency mako 1.3.10: PYSEC-2026-88"}, "fullDescription": {"text": "OSV.dev reports `mako` at version `1.3.10` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-88.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-88\nFix: upgrade `mako` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5787459ac28367f", "name": "Vulnerable dependency mcp 1.26.0: GHSA-hvrp-rf83-w775", "shortDescription": {"text": "Vulnerable dependency mcp 1.26.0: GHSA-hvrp-rf83-w775"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.26.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-hvrp-rf83-w775.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hvrp-rf83-w775\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f9580253d214148", "name": "Vulnerable dependency mcp 1.26.0: GHSA-jpw9-pfvf-9f58", "shortDescription": {"text": "Vulnerable dependency mcp 1.26.0: GHSA-jpw9-pfvf-9f58"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.26.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-jpw9-pfvf-9f58.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89abfc399bf79896", "name": "Vulnerable dependency mcp 1.26.0: GHSA-vj7q-gjh5-988w", "shortDescription": {"text": "Vulnerable dependency mcp 1.26.0: GHSA-vj7q-gjh5-988w"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.26.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-vj7q-gjh5-988w.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vj7q-gjh5-988w\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0771fe1bef6e9d5a", "name": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3481", "shortDescription": {"text": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3481"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.26.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3481.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3481\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8ba3e867f93c0eb", "name": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3482", "shortDescription": {"text": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3482"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.26.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3482.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3482\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d851315053ac2334", "name": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3483", "shortDescription": {"text": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3483"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.26.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3483.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3483\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f8b50c352db88e9", "name": "Vulnerable dependency msgpack 1.1.2: GHSA-6v7p-g79w-8964", "shortDescription": {"text": "Vulnerable dependency msgpack 1.1.2: GHSA-6v7p-g79w-8964"}, "fullDescription": {"text": "OSV.dev reports `msgpack` at version `1.1.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-6v7p-g79w-8964.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6v7p-g79w-8964\nFix: upgrade `msgpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a26de7966f56918e", "name": "Vulnerable dependency msgpack 1.1.2: PYSEC-2026-3625", "shortDescription": {"text": "Vulnerable dependency msgpack 1.1.2: PYSEC-2026-3625"}, "fullDescription": {"text": "OSV.dev reports `msgpack` at version `1.1.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3625.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3625\nFix: upgrade `msgpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fa4a873a19a6432", "name": "Vulnerable dependency nltk 3.9.2: GHSA-3gq4-3j92-5w49", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-3gq4-3j92-5w49"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-3gq4-3j92-5w49.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3gq4-3j92-5w49\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17acff953c797778", "name": "Vulnerable dependency nltk 3.9.2: GHSA-3gqm-fcw5-w839", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-3gqm-fcw5-w839"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-3gqm-fcw5-w839.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3gqm-fcw5-w839\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7ad18a6b832432b", "name": "Vulnerable dependency nltk 3.9.2: GHSA-469j-vmhf-r6v7", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-469j-vmhf-r6v7"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-469j-vmhf-r6v7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-469j-vmhf-r6v7\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17b49608c92006ef", "name": "Vulnerable dependency nltk 3.9.2: GHSA-568f-pv23-39p4", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-568f-pv23-39p4"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-568f-pv23-39p4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-568f-pv23-39p4\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e57d778816c25ffa", "name": "Vulnerable dependency nltk 3.9.2: GHSA-5wp5-5229-5g6q", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-5wp5-5229-5g6q"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-5wp5-5229-5g6q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5wp5-5229-5g6q\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbd3b51265e05ec8", "name": "Vulnerable dependency nltk 3.9.2: GHSA-68j8-pq59-fqgm", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-68j8-pq59-fqgm"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-68j8-pq59-fqgm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-68j8-pq59-fqgm\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-437ece22eaf4bb4a", "name": "Vulnerable dependency nltk 3.9.2: GHSA-6hm5-jgcp-p838", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-6hm5-jgcp-p838"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-6hm5-jgcp-p838.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6hm5-jgcp-p838\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1948cb708a28445a", "name": "Vulnerable dependency nltk 3.9.2: GHSA-6hwm-xvph-95vm", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-6hwm-xvph-95vm"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-6hwm-xvph-95vm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6hwm-xvph-95vm\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6d663c0f3f693e1", "name": "Vulnerable dependency nltk 3.9.2: GHSA-6ww7-3frv-cqxh", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-6ww7-3frv-cqxh"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-6ww7-3frv-cqxh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6ww7-3frv-cqxh\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e3b53aeae94fdb4", "name": "Vulnerable dependency nltk 3.9.2: GHSA-72r2-7mfr-5xr9", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-72r2-7mfr-5xr9"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-72r2-7mfr-5xr9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-72r2-7mfr-5xr9\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd109961a561ef11", "name": "Vulnerable dependency nltk 3.9.2: GHSA-7p94-766c-hgjp", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-7p94-766c-hgjp"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-7p94-766c-hgjp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7p94-766c-hgjp\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2de43a46229e77e", "name": "Vulnerable dependency nltk 3.9.2: GHSA-848c-c2cx-j7qx", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-848c-c2cx-j7qx"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-848c-c2cx-j7qx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-848c-c2cx-j7qx\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5366e71652c926ca", "name": "Vulnerable dependency nltk 3.9.2: GHSA-8mgp-746c-j5xp", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-8mgp-746c-j5xp"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-8mgp-746c-j5xp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8mgp-746c-j5xp\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9281ec31845fdfe4", "name": "Vulnerable dependency nltk 3.9.2: GHSA-8mpw-7fpc-4gqj", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-8mpw-7fpc-4gqj"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-8mpw-7fpc-4gqj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8mpw-7fpc-4gqj\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f0388c3bd15de2b", "name": "Vulnerable dependency nltk 3.9.2: GHSA-97qj-x29f-37w7", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-97qj-x29f-37w7"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-97qj-x29f-37w7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-97qj-x29f-37w7\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e15bee2e8cf197f", "name": "Vulnerable dependency nltk 3.9.2: GHSA-cw6x-m8jw-qmrh", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-cw6x-m8jw-qmrh"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-cw6x-m8jw-qmrh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cw6x-m8jw-qmrh\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-efd362786684374c", "name": "Vulnerable dependency nltk 3.9.2: GHSA-f794-5jv7-7672", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-f794-5jv7-7672"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-f794-5jv7-7672.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f794-5jv7-7672\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86418590e6db2b2d", "name": "Vulnerable dependency nltk 3.9.2: GHSA-ff5c-cp5c-9wjf", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-ff5c-cp5c-9wjf"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-ff5c-cp5c-9wjf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ff5c-cp5c-9wjf\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a81c79c7f507fa2", "name": "Vulnerable dependency nltk 3.9.2: GHSA-fg7f-2386-8897", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-fg7f-2386-8897"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-fg7f-2386-8897.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fg7f-2386-8897\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9762dfd14563555d", "name": "Vulnerable dependency nltk 3.9.2: GHSA-gfwx-w7gr-fvh7", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-gfwx-w7gr-fvh7"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-gfwx-w7gr-fvh7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gfwx-w7gr-fvh7\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42233918f00a0a27", "name": "Vulnerable dependency nltk 3.9.2: GHSA-h8wq-7xc4-p3qx", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-h8wq-7xc4-p3qx"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-h8wq-7xc4-p3qx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h8wq-7xc4-p3qx\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd27b996eb1c5b43", "name": "Vulnerable dependency nltk 3.9.2: GHSA-jm6w-m3j8-898g", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-jm6w-m3j8-898g"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-jm6w-m3j8-898g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jm6w-m3j8-898g\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-139a13c0fdb9983d", "name": "Vulnerable dependency nltk 3.9.2: GHSA-m42h-3232-vpv3", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-m42h-3232-vpv3"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-m42h-3232-vpv3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m42h-3232-vpv3\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cba428b9e0c5af48", "name": "Vulnerable dependency nltk 3.9.2: GHSA-m4rf-3fr8-xwx3", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-m4rf-3fr8-xwx3"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-m4rf-3fr8-xwx3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m4rf-3fr8-xwx3\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-180a5ea1096fb2aa", "name": "Vulnerable dependency nltk 3.9.2: GHSA-p3m8-78j2-g5p3", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-p3m8-78j2-g5p3"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-p3m8-78j2-g5p3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p3m8-78j2-g5p3\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a463c584218a4179", "name": "Vulnerable dependency nltk 3.9.2: GHSA-p4gq-832x-fm9v", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-p4gq-832x-fm9v"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-p4gq-832x-fm9v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p4gq-832x-fm9v\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-546c34741c899a30", "name": "Vulnerable dependency nltk 3.9.2: GHSA-p4rw-rvv2-7xwr", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-p4rw-rvv2-7xwr"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-p4rw-rvv2-7xwr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p4rw-rvv2-7xwr\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91cf1f4425892f8e", "name": "Vulnerable dependency nltk 3.9.2: GHSA-qvv7-cg9c-w4x3", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-qvv7-cg9c-w4x3"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-qvv7-cg9c-w4x3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qvv7-cg9c-w4x3\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a4c798db317d90f", "name": "Vulnerable dependency nltk 3.9.2: GHSA-qx2g-xrx7-vfh8", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-qx2g-xrx7-vfh8"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-qx2g-xrx7-vfh8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2g-xrx7-vfh8\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8446d22a92242657", "name": "Vulnerable dependency nltk 3.9.2: GHSA-r6gq-whwq-mvg9", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-r6gq-whwq-mvg9"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-r6gq-whwq-mvg9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r6gq-whwq-mvg9\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b95e5a48a96a3bba", "name": "Vulnerable dependency nltk 3.9.2: GHSA-rf74-v2fm-23pw", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-rf74-v2fm-23pw"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-rf74-v2fm-23pw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rf74-v2fm-23pw\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eedee12884049197", "name": "Vulnerable dependency nltk 3.9.2: GHSA-rhp5-r9x4-f5g2", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-rhp5-r9x4-f5g2"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-rhp5-r9x4-f5g2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rhp5-r9x4-f5g2\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d70d05524bb202d", "name": "Vulnerable dependency nltk 3.9.2: GHSA-rrv8-h7p8-rx55", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-rrv8-h7p8-rx55"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-rrv8-h7p8-rx55.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rrv8-h7p8-rx55\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26210f5da3e429b2", "name": "Vulnerable dependency nltk 3.9.2: GHSA-vp2x-qp44-57v7", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-vp2x-qp44-57v7"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-vp2x-qp44-57v7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vp2x-qp44-57v7\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3df6c38b6fa4d713", "name": "Vulnerable dependency nltk 3.9.2: GHSA-w3v8-gmh9-3wv7", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-w3v8-gmh9-3wv7"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-w3v8-gmh9-3wv7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w3v8-gmh9-3wv7\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aeb6916bcc03c9f", "name": "Vulnerable dependency nltk 3.9.2: GHSA-ww6m-cw3f-q94g", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-ww6m-cw3f-q94g"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-ww6m-cw3f-q94g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ww6m-cw3f-q94g\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-850fbae352c1ccd4", "name": "Vulnerable dependency nltk 3.9.2: GHSA-x5ph-mj9p-rfr8", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-x5ph-mj9p-rfr8"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-x5ph-mj9p-rfr8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x5ph-mj9p-rfr8\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7bf678a3be2c2aea", "name": "Vulnerable dependency nltk 3.9.2: GHSA-x99w-6fgc-pmfw", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-x99w-6fgc-pmfw"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-x99w-6fgc-pmfw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x99w-6fgc-pmfw\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09679c85435d9dd3", "name": "Vulnerable dependency nltk 3.9.2: GHSA-xh95-f55m-82fw", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-xh95-f55m-82fw"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-xh95-f55m-82fw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xh95-f55m-82fw\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e55d01f046029e3", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2078", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2078"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2078.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2078\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8ad61ca47bf3e10", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2085", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2085"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2085.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2085\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e31e2a91069f2189", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2235", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2235"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2235.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2235\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffb0d786b80c7deb", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2236", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2236"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2236.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2236\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-974aa01beb221a69", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2237", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2237"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2237.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2237\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-225a3430a6d4e113", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3581", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3581"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3581.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3581\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f51f5264f6252a9", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3582", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3582"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3582.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3582\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c80d8142569a9ce", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3583", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3583"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3583.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3583\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-582db587d773363d", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3584", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3584"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3584.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3584\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5f70d62a17e433b", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3657", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3657"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3657.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3657\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c86fc62b1e6963ac", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3722", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3722"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3722.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3722\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8e6a38b61e0ae2b", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3723", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3723"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3723.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3723\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46f537cf91fdafc4", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3724", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3724"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3724.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3724\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a9e93c027858210", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3728", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3728"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3728.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3728\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e53e8da62be3954a", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3729", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3729"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3729.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3729\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c164f092564ff436", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3730", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3730"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3730.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3730\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-776e47750927adc9", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3731", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3731"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3731.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3731\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77fdc7b09d5c0bb4", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3732", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3732"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3732.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3732\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-153d7f1b8310dd93", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3733", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3733"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3733.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3733\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c91f2513ec440cc7", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3734", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3734"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3734.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3734\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-236f12180171a9bb", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3735", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3735"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3735.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3735\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a30758488fb0d2b", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3736", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3736"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3736.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3736\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9662dfa2daeb0360", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3737", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3737"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3737.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3737\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b89ee2affb54f8c", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3738", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3738"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3738.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3738\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eda4a1afec456d39", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3739", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3739"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3739.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3739\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-211015087b4ad7a0", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3740", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3740"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3740.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3740\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea927deee6dc5d97", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3741", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3741"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3741.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3741\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca7de73ee81f7693", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3748", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3748"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3748.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3748\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d93e390bec40565", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3749", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3749"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3749.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3749\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8bb368d3a7a05cf", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3750", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3750"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3750.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3750\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3accf65e17ce592", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3751", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3751"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3751.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3751\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e83a285c91df99d", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3752", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3752"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3752.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3752\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f633d43dc1806402", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3868", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3868"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3868.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3868\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23e4e9ab51f8a299", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3869", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3869"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3869.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3869\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06e87b4ecab7e06b", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3870", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3870"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3870.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3870\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6e313535765254b", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3871", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3871"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3871.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3871\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1a676614199c2b4", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3954", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3954"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3954.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3954\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aaee90635ccc84bd", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3955", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3955"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3955.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3955\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13c26e5efc84cff2", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-597", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-597"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-597.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-597\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-129336c776b9340a", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-96", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-96"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-96.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-96\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3637616243caceda", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-97", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-97"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-97.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-97\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d48a3d6ea354251", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-98", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-98"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-98.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-98\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd8414d2790d5b7b", "name": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-99", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-99"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-99.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-99\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fe415f94b885ef4", "name": "Vulnerable dependency orjson 3.11.5: GHSA-hx9q-6w63-j58v", "shortDescription": {"text": "Vulnerable dependency orjson 3.11.5: GHSA-hx9q-6w63-j58v"}, "fullDescription": {"text": "OSV.dev reports `orjson` at version `3.11.5` (resolved in `futureagi/uv.lock`) is affected by GHSA-hx9q-6w63-j58v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hx9q-6w63-j58v\nFix: upgrade `orjson` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-742f1ecef50fbf55", "name": "Vulnerable dependency pdfminer-six 20231228: GHSA-f83h-ghpp-7wcc", "shortDescription": {"text": "Vulnerable dependency pdfminer-six 20231228: GHSA-f83h-ghpp-7wcc"}, "fullDescription": {"text": "OSV.dev reports `pdfminer-six` at version `20231228` (resolved in `futureagi/uv.lock`) is affected by GHSA-f83h-ghpp-7wcc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f83h-ghpp-7wcc\nFix: upgrade `pdfminer-six` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd93713bc727bb8f", "name": "Vulnerable dependency pdfminer-six 20231228: GHSA-wf5f-4jwr-ppcp", "shortDescription": {"text": "Vulnerable dependency pdfminer-six 20231228: GHSA-wf5f-4jwr-ppcp"}, "fullDescription": {"text": "OSV.dev reports `pdfminer-six` at version `20231228` (resolved in `futureagi/uv.lock`) is affected by GHSA-wf5f-4jwr-ppcp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wf5f-4jwr-ppcp\nFix: upgrade `pdfminer-six` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ddd6f0aceeb95c9", "name": "Vulnerable dependency pdfminer-six 20231228: PYSEC-2026-1761", "shortDescription": {"text": "Vulnerable dependency pdfminer-six 20231228: PYSEC-2026-1761"}, "fullDescription": {"text": "OSV.dev reports `pdfminer-six` at version `20231228` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1761.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1761\nFix: upgrade `pdfminer-six` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb9b7bdcead367f8", "name": "Vulnerable dependency pdfminer-six 20231228: PYSEC-2026-1762", "shortDescription": {"text": "Vulnerable dependency pdfminer-six 20231228: PYSEC-2026-1762"}, "fullDescription": {"text": "OSV.dev reports `pdfminer-six` at version `20231228` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1762.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1762\nFix: upgrade `pdfminer-six` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37b0ae97549c6bc8", "name": "Vulnerable dependency pillow 12.1.0: GHSA-45hq-cxwh-f6vc", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-45hq-cxwh-f6vc"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-45hq-cxwh-f6vc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-45hq-cxwh-f6vc\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-265478397d78642b", "name": "Vulnerable dependency pillow 12.1.0: GHSA-4x4j-2g7c-83w6", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-4x4j-2g7c-83w6"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-4x4j-2g7c-83w6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4x4j-2g7c-83w6\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26f92a070e4497da", "name": "Vulnerable dependency pillow 12.1.0: GHSA-5x94-69rx-g8h2", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-5x94-69rx-g8h2"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-5x94-69rx-g8h2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5x94-69rx-g8h2\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f13cd263147856f9", "name": "Vulnerable dependency pillow 12.1.0: GHSA-5xmw-vc9v-4wf2", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-5xmw-vc9v-4wf2"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-5xmw-vc9v-4wf2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1071d621bfe60b32", "name": "Vulnerable dependency pillow 12.1.0: GHSA-62p4-gmf7-7g93", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-62p4-gmf7-7g93"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-62p4-gmf7-7g93.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-62p4-gmf7-7g93\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a2337a4600bb977", "name": "Vulnerable dependency pillow 12.1.0: GHSA-6r8x-57c9-28j4", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-6r8x-57c9-28j4"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-6r8x-57c9-28j4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6r8x-57c9-28j4\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e91d9765a0e72829", "name": "Vulnerable dependency pillow 12.1.0: GHSA-8v84-f9pq-wr9x", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-8v84-f9pq-wr9x"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-8v84-f9pq-wr9x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8v84-f9pq-wr9x\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7eb06035fcf7190f", "name": "Vulnerable dependency pillow 12.1.0: GHSA-9hw9-ch79-4vh6", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-9hw9-ch79-4vh6"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-9hw9-ch79-4vh6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9hw9-ch79-4vh6\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8e00915ba70be64", "name": "Vulnerable dependency pillow 12.1.0: GHSA-cfh3-3jmp-rvhc", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-cfh3-3jmp-rvhc"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-cfh3-3jmp-rvhc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cfh3-3jmp-rvhc\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-940e02ccfacbde0f", "name": "Vulnerable dependency pillow 12.1.0: GHSA-fj7v-r99m-22gq", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-fj7v-r99m-22gq"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-fj7v-r99m-22gq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fj7v-r99m-22gq\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98deeb6fd66195da", "name": "Vulnerable dependency pillow 12.1.0: GHSA-jjj6-mw9f-p565", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-jjj6-mw9f-p565"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-jjj6-mw9f-p565.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jjj6-mw9f-p565\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aa76375ef24e406", "name": "Vulnerable dependency pillow 12.1.0: GHSA-pg7v-jwj7-p798", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-pg7v-jwj7-p798"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-pg7v-jwj7-p798.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pg7v-jwj7-p798\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6096b0b6ec35406", "name": "Vulnerable dependency pillow 12.1.0: GHSA-phj9-mv4w-65pm", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-phj9-mv4w-65pm"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-phj9-mv4w-65pm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-phj9-mv4w-65pm\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76d02c738e01ef17", "name": "Vulnerable dependency pillow 12.1.0: GHSA-pwv6-vv43-88gr", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-pwv6-vv43-88gr"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-pwv6-vv43-88gr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4236b6f1601fe2c", "name": "Vulnerable dependency pillow 12.1.0: GHSA-r73j-pqj5-w3x7", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-r73j-pqj5-w3x7"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-r73j-pqj5-w3x7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r73j-pqj5-w3x7\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f90a1f0f42ecb33e", "name": "Vulnerable dependency pillow 12.1.0: GHSA-vjc4-5qp5-m44j", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-vjc4-5qp5-m44j"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-vjc4-5qp5-m44j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vjc4-5qp5-m44j\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d247991187bbcb38", "name": "Vulnerable dependency pillow 12.1.0: GHSA-whj4-6x5x-4v2j", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-whj4-6x5x-4v2j"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-whj4-6x5x-4v2j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ef93e6e1403f00d", "name": "Vulnerable dependency pillow 12.1.0: GHSA-wjx4-4jcj-g98j", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-wjx4-4jcj-g98j"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-wjx4-4jcj-g98j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wjx4-4jcj-g98j\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fde71fd895b72049", "name": "Vulnerable dependency pillow 12.1.0: GHSA-xj96-63gp-2gmr", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-xj96-63gp-2gmr"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-xj96-63gp-2gmr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xj96-63gp-2gmr\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bac000d01aa39c96", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-165", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-165"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-165.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-165\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-daeb33b73de30caf", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2249", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2249"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2249.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2249\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae962457f2a882f0", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2250", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2250"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2250.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2250\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e43584b6f69de04", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2251", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2251"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2251.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2251\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d77689b64e532094", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2252", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2252"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2252.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2252\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-934670306f56f391", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2253", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2253"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2253.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2253\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c777ec64452201b6", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2254", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2254"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2254.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2254\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f25226e0d8915540", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2255", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2255"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2255.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2255\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c29efc9200f6bf06", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2256", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2256"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2256.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2256\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-caf261bc9ffa82c2", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2257", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2257"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2257.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2257\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de1801db90c2aa89", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2874", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2874"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2874.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2874\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d539a7fd862fc1f2", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3451", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3451"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3451.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3451\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-314ead1f6b2cf7c1", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3452", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3452"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3452.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3452\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ad28faafdaaa035", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3453", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3453"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3453.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3453\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d440b130170fca1f", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3454", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3454"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3454.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3454\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5034ee01c9f97bb3", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3493", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3493"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3493.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3493\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fe4d553c39e516c", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3494", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3494"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3494.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3494\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18f1a0841daec9f0", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3495", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3495"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3495.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3495\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4515a479f99e5263", "name": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3496", "shortDescription": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3496"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.1.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3496.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3496\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b747a28ad768f258", "name": "Vulnerable dependency pyarrow 22.0.0: GHSA-rgxp-2hwp-jwgg", "shortDescription": {"text": "Vulnerable dependency pyarrow 22.0.0: GHSA-rgxp-2hwp-jwgg"}, "fullDescription": {"text": "OSV.dev reports `pyarrow` at version `22.0.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-rgxp-2hwp-jwgg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rgxp-2hwp-jwgg\nFix: upgrade `pyarrow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-092b9a907a8e04e8", "name": "Vulnerable dependency pyarrow 22.0.0: PYSEC-2026-113", "shortDescription": {"text": "Vulnerable dependency pyarrow 22.0.0: PYSEC-2026-113"}, "fullDescription": {"text": "OSV.dev reports `pyarrow` at version `22.0.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-113.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-113\nFix: upgrade `pyarrow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-519e186c14d3d9b9", "name": "Vulnerable dependency pyasn1 0.6.1: GHSA-63vm-454h-vhhq", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-63vm-454h-vhhq"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-63vm-454h-vhhq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-63vm-454h-vhhq\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db1bc0be762f3721", "name": "Vulnerable dependency pyasn1 0.6.1: GHSA-8ppf-4f7h-5ppj", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-8ppf-4f7h-5ppj"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-8ppf-4f7h-5ppj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8ppf-4f7h-5ppj\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b051c1e8dd8fddd", "name": "Vulnerable dependency pyasn1 0.6.1: GHSA-hm4w-wwcw-mr6r", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-hm4w-wwcw-mr6r"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-hm4w-wwcw-mr6r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hm4w-wwcw-mr6r\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba4964d20f392a02", "name": "Vulnerable dependency pyasn1 0.6.1: GHSA-jr27-m4p2-rc6r", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-jr27-m4p2-rc6r"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-jr27-m4p2-rc6r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jr27-m4p2-rc6r\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-770aa0c3aa68c683", "name": "Vulnerable dependency pyasn1 0.6.1: GHSA-m4p7-r5rc-7g4j", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-m4p7-r5rc-7g4j"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-m4p7-r5rc-7g4j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m4p7-r5rc-7g4j\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b66b288df5d6381", "name": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-1810", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-1810"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1810.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1810\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44b441ba7ab3f945", "name": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-2263", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-2263"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2263.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2263\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-804d8ef266672bec", "name": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3455", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3455"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3455.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3455\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cddde09877ac5a0", "name": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3456", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3456"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3456.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3456\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14fe923086251812", "name": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3457", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3457"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3457.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3457\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74ed0096e07009e8", "name": "Vulnerable dependency pydantic-settings 2.12.0: GHSA-4xgf-cpjx-pc3j", "shortDescription": {"text": "Vulnerable dependency pydantic-settings 2.12.0: GHSA-4xgf-cpjx-pc3j"}, "fullDescription": {"text": "OSV.dev reports `pydantic-settings` at version `2.12.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-4xgf-cpjx-pc3j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j\nFix: upgrade `pydantic-settings` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-398dcfc9295e08cd", "name": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq", "shortDescription": {"text": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq"}, "fullDescription": {"text": "OSV.dev reports `pygments` at version `2.19.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-5239-wwwm-4pmq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5239-wwwm-4pmq\nFix: upgrade `pygments` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e1507733f542c28", "name": "Vulnerable dependency pygments 2.19.2: PYSEC-2026-2987", "shortDescription": {"text": "Vulnerable dependency pygments 2.19.2: PYSEC-2026-2987"}, "fullDescription": {"text": "OSV.dev reports `pygments` at version `2.19.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2987.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2987\nFix: upgrade `pygments` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bddf7db07cb19b05", "name": "Vulnerable dependency pyjwt 2.10.1: GHSA-752w-5fwx-jx9f", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-752w-5fwx-jx9f"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-752w-5fwx-jx9f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-752w-5fwx-jx9f\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3cb0b003eb924a6b", "name": "Vulnerable dependency pyjwt 2.10.1: GHSA-993g-76c3-p5m4", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-993g-76c3-p5m4"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-993g-76c3-p5m4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-993g-76c3-p5m4\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68765d0971d6c2da", "name": "Vulnerable dependency pyjwt 2.10.1: GHSA-fhv5-28vv-h8m8", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-fhv5-28vv-h8m8"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-fhv5-28vv-h8m8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fhv5-28vv-h8m8\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4fd05e167e3f798", "name": "Vulnerable dependency pyjwt 2.10.1: GHSA-jq35-7prp-9v3f", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-jq35-7prp-9v3f"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-jq35-7prp-9v3f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jq35-7prp-9v3f\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2211e6971a1746a7", "name": "Vulnerable dependency pyjwt 2.10.1: GHSA-w7vc-732c-9m39", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-w7vc-732c-9m39"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-w7vc-732c-9m39.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w7vc-732c-9m39\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1881b15d57696d97", "name": "Vulnerable dependency pyjwt 2.10.1: GHSA-xgmm-8j9v-c9wx", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-xgmm-8j9v-c9wx"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-xgmm-8j9v-c9wx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xgmm-8j9v-c9wx\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67555c70542d21fa", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2025-183", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2025-183"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2025-183.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2025-183\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-848c1cdf908518bb", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-120", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-120"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-120.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-120\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e41344da90e886b7", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-175", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-175"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-175.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-175\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc510c6154bd92cb", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-176", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-176"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-176.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-176\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd194783a515326f", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-177", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-177"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-177.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-177\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-702cc25cd7238c90", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-178", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-178"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-178.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-178\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b76f48fb708a978", "name": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-179", "shortDescription": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-179"}, "fullDescription": {"text": "OSV.dev reports `pyjwt` at version `2.10.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-179.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-179\nFix: upgrade `pyjwt` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e493b4a30b129738", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-23w6-3w8w-8484", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-23w6-3w8w-8484"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-23w6-3w8w-8484 (aka CVE-2026-84310).\n\npypdf: Possible long runtimes/large memory usage when retrieving outlines\n\nAliases: CVE-2026-84310, PYSEC-2026-3910\nAdvisory: https://osv.dev/vulnerability/GHSA-23w6-3w8w-8484\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7907c63bfbf1d9ad", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-248m-82v9-q6g6", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-248m-82v9-q6g6"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-248m-82v9-q6g6 (aka CVE-2026-48156).\n\npypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams\n\nAliases: CVE-2026-48156, PYSEC-2026-3004\nAdvisory: https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9d2d3a1b0940d6a", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-2q4j-m29v-hq73", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-2q4j-m29v-hq73"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-2q4j-m29v-hq73.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2q4j-m29v-hq73\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fba47c9307ddbf9d", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-2rw7-x74f-jg35", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-2rw7-x74f-jg35"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-2rw7-x74f-jg35.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2rw7-x74f-jg35\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b3c19c1d668e047", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-3crg-w4f6-42mx", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-3crg-w4f6-42mx"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-3crg-w4f6-42mx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3crg-w4f6-42mx\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1449b4a97bee7e7c", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-4pxv-j86v-mhcw", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-4pxv-j86v-mhcw"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-4pxv-j86v-mhcw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4pxv-j86v-mhcw\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08b3f248ec42af50", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-52x6-gq3r-vpf4", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-52x6-gq3r-vpf4"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-52x6-gq3r-vpf4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-52x6-gq3r-vpf4\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4dc2b43f3a1799b", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-55h5-xmcq-c37v", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-55h5-xmcq-c37v"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-55h5-xmcq-c37v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-55h5-xmcq-c37v\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f000e1319e213a7", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-5hgr-hg42-57jg", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-5hgr-hg42-57jg"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-5hgr-hg42-57jg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5hgr-hg42-57jg\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7749f5e79af8aa8a", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-5qjq-93h5-hrgp", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-5qjq-93h5-hrgp"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-5qjq-93h5-hrgp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5qjq-93h5-hrgp\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18627cc3d9e9b7fc", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-5xf7-4p34-54qr", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-5xf7-4p34-54qr"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-5xf7-4p34-54qr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5xf7-4p34-54qr\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3153534a7a9fd4b", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-763m-79hh-57f2", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-763m-79hh-57f2"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-763m-79hh-57f2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-763m-79hh-57f2\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6eb77cf5b3b52aac", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-7gw9-cf7v-778f", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-7gw9-cf7v-778f"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-7gw9-cf7v-778f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7gw9-cf7v-778f\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17b7a444f4b4d9f9", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-87mj-5ggw-8qc3", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-87mj-5ggw-8qc3"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-87mj-5ggw-8qc3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-87mj-5ggw-8qc3\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a8056162e0b519d", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-996q-pr4m-cvgq", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-996q-pr4m-cvgq"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-996q-pr4m-cvgq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-996q-pr4m-cvgq\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-678c10b199cfc6f5", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-9m86-7pmv-2852", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-9m86-7pmv-2852"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-9m86-7pmv-2852.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9m86-7pmv-2852\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5edb1663ba4663c4", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-9mvc-8737-8j8h", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-9mvc-8737-8j8h"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-9mvc-8737-8j8h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9mvc-8737-8j8h\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c183d2ae2439934", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-cj93-chg6-vgv8", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-cj93-chg6-vgv8"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-cj93-chg6-vgv8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cj93-chg6-vgv8\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e29d8820f688b5f", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-f2v5-7jq9-h8cg", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-f2v5-7jq9-h8cg"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-f2v5-7jq9-h8cg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f2v5-7jq9-h8cg\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-324bec1def78134c", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-fc8x-2rww-xw9m", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-fc8x-2rww-xw9m"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-fc8x-2rww-xw9m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fc8x-2rww-xw9m\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c28caacf02f3d230", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-fp3f-mc75-235c", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-fp3f-mc75-235c"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-fp3f-mc75-235c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fp3f-mc75-235c\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-778e20eedadbbbcf", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-fwg2-594c-jp42", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-fwg2-594c-jp42"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-fwg2-594c-jp42.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fwg2-594c-jp42\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3d045435eaae354", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-g867-7843-wf8q", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-g867-7843-wf8q"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-g867-7843-wf8q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g867-7843-wf8q\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e9353bbe9d5e445", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-g9xf-7f8q-9mcj", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-g9xf-7f8q-9mcj"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-g9xf-7f8q-9mcj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g9xf-7f8q-9mcj\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f470b26faaa83bf", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-hqmh-ppp3-xvm7", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-hqmh-ppp3-xvm7"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-hqmh-ppp3-xvm7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hqmh-ppp3-xvm7\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0bd8aec670fe8b6", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-j543-4vmf-qm7v", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-j543-4vmf-qm7v"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-j543-4vmf-qm7v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j543-4vmf-qm7v\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a803f8630c4e20d", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-jj6c-8h6c-hppx", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-jj6c-8h6c-hppx"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-jj6c-8h6c-hppx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jj6c-8h6c-hppx\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97a63c284cb355d9", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-jm82-fx9c-mx94", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-jm82-fx9c-mx94"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-jm82-fx9c-mx94.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jm82-fx9c-mx94\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bceb7763c6886f56", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-jp53-mhqp-8xcg", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-jp53-mhqp-8xcg"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-jp53-mhqp-8xcg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jp53-mhqp-8xcg\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90c7de9510c69ad7", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-m2v9-299j-rv96", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-m2v9-299j-rv96"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-m2v9-299j-rv96.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m2v9-299j-rv96\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92795d700fb3e3c5", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-qpxp-75px-xjcp", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-qpxp-75px-xjcp"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-qpxp-75px-xjcp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qpxp-75px-xjcp\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2217cf740dc70b84", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-wgvp-vg3v-2xq3", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-wgvp-vg3v-2xq3"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-wgvp-vg3v-2xq3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wgvp-vg3v-2xq3\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bca65c9c8b42c44a", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-wjqc-6w8f-h24c", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-wjqc-6w8f-h24c"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-wjqc-6w8f-h24c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wjqc-6w8f-h24c\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b88331af23f5836", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-x284-j5p8-9c5p", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-x284-j5p8-9c5p"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-x284-j5p8-9c5p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x284-j5p8-9c5p\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d86598df67364b9e", "name": "Vulnerable dependency pypdf 6.6.0: GHSA-x7hp-r3qg-r3cj", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-x7hp-r3qg-r3cj"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by GHSA-x7hp-r3qg-r3cj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x7hp-r3qg-r3cj\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58c1508eed9a49cb", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-1827", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-1827"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1827.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1827\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54a12bd5316fc711", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3005", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3005"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3005.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3005\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb02e260560ee857", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3006", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3006"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3006.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3006\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8674b2de4695da7", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3007", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3007"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3007.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3007\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b88fa43d8eb8b8da", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3009", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3009"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3009.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3009\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d21840873f5b1fa4", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3010", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3010"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3010.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3010\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8350c9709815a6b2", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3011", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3011"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3011.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3011\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f08c12c79168284", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3012", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3012"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3012.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3012\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16c70733110930b9", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3013", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3013"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3013.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3013\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51e728690cea498e", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3014", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3014"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3014.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3014\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b688428ccccc9b9b", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3015", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3015"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3015.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3015\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f77839506846dcc8", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3016", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3016"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3016.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3016\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9121641602222e60", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3017", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3017"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3017.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3017\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b38edce702d00bb5", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3018", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3018"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3018.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3018\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c34483c2df6f1e9f", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3019", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3019"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3019.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3019\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee8d3f59109a691d", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3020", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3020"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3020.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3020\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad18899682ab2616", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3021", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3021"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3021.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3021\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e7cf3d7b87a76d1", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3022", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3022"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3022.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3022\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41736884e7129214", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3023", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3023"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3023.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3023\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-214c6578bd39c6cb", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3024", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3024"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3024.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3024\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8181b9901339ccbb", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3025", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3025"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3025.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3025\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14119680e614fcd8", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3026", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3026"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3026.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3026\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c55301b168d0cdc5", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3027", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3027"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3027.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3027\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-622218bc1b8e6d0f", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3610", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3610"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3610.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3610\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da14c8cbe8e5247a", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3611", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3611"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3611.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3611\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2269868896e16af0", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3612", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3612"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3612.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3612\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5706c2fee825e4e5", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3613", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3613"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3613.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3613\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73f828cf592b621f", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3655", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3655"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3655.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3655\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebb31cf621a16967", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3656", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3656"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3656.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3656\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f386d3c67e970746", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3911", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3911"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3911.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3911\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d225a392f2f6b1b", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3912", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3912"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3912.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3912\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e19c82fbb449a2b7", "name": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3913", "shortDescription": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3913"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.6.0` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-3913.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3913\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3b7cca938d97d63", "name": "Vulnerable dependency pytest 9.0.2: GHSA-6w46-j5rx-g56g", "shortDescription": {"text": "Vulnerable dependency pytest 9.0.2: GHSA-6w46-j5rx-g56g"}, "fullDescription": {"text": "OSV.dev reports `pytest` at version `9.0.2` (resolved in `futureagi/uv.lock`) is affected by GHSA-6w46-j5rx-g56g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6w46-j5rx-g56g\nFix: upgrade `pytest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c23c2018b3e51041", "name": "Vulnerable dependency pytest 9.0.2: PYSEC-2026-1845", "shortDescription": {"text": "Vulnerable dependency pytest 9.0.2: PYSEC-2026-1845"}, "fullDescription": {"text": "OSV.dev reports `pytest` at version `9.0.2` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-1845.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1845\nFix: upgrade `pytest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8c345b21ba3d9772", "name": "Vulnerable dependency python-dotenv 1.2.1: GHSA-mf9w-mj56-hr94", "shortDescription": {"text": "Vulnerable dependency python-dotenv 1.2.1: GHSA-mf9w-mj56-hr94"}, "fullDescription": {"text": "OSV.dev reports `python-dotenv` at version `1.2.1` (resolved in `futureagi/uv.lock`) is affected by GHSA-mf9w-mj56-hr94.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94\nFix: upgrade `python-dotenv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d65bbc995b802ee", "name": "Vulnerable dependency python-dotenv 1.2.1: PYSEC-2026-2270", "shortDescription": {"text": "Vulnerable dependency python-dotenv 1.2.1: PYSEC-2026-2270"}, "fullDescription": {"text": "OSV.dev reports `python-dotenv` at version `1.2.1` (resolved in `futureagi/uv.lock`) is affected by PYSEC-2026-2270.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2270\nFix: upgrade `python-dotenv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f69f9f51dc6d74b9", "name": "Dependency @dagrejs/dagre is two or more major versions behind", "shortDescription": {"text": "Dependency @dagrejs/dagre is two or more major versions behind"}, "fullDescription": {"text": "`@dagrejs/dagre` is pinned at `1.1.5` in `frontend/package.json` while the latest release on the npm registry is `3.1.1` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@dagrejs/dagre` to `3.1.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-60540be043ad9776", "name": "Dependency @dnd-kit/sortable is two or more major versions behind", "shortDescription": {"text": "Dependency @dnd-kit/sortable is two or more major versions behind"}, "fullDescription": {"text": "`@dnd-kit/sortable` is pinned at `8.0.0` in `frontend/package.json` while the latest release on the npm registry is `10.0.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@dnd-kit/sortable` to `10.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-dc5ee730904409ae", "name": "Dependency @hookform/resolvers is two or more major versions behind", "shortDescription": {"text": "Dependency @hookform/resolvers is two or more major versions behind"}, "fullDescription": {"text": "`@hookform/resolvers` is pinned at `3.6.0` in `frontend/package.json` while the latest release on the npm registry is `5.9.1` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@hookform/resolvers` to `5.9.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-af63346a6b85f845", "name": "Dependency @iconify/react is two or more major versions behind", "shortDescription": {"text": "Dependency @iconify/react is two or more major versions behind"}, "fullDescription": {"text": "`@iconify/react` is pinned at `4.1.1` in `frontend/package.json` while the latest release on the npm registry is `6.0.2` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@iconify/react` to `6.0.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3bacc56e5da05920", "name": "Dependency @mui/lab is two or more major versions behind", "shortDescription": {"text": "Dependency @mui/lab is two or more major versions behind"}, "fullDescription": {"text": "`@mui/lab` is pinned at `5.0.0-alpha.147` in `frontend/package.json` while the latest release on the npm registry is `9.0.0-beta.9` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@mui/lab` to `9.0.0-beta.9`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f58fa2fcf27df017", "name": "Dependency @mui/material is two or more major versions behind", "shortDescription": {"text": "Dependency @mui/material is two or more major versions behind"}, "fullDescription": {"text": "`@mui/material` is pinned at `5.14.12` in `frontend/package.json` while the latest release on the npm registry is `9.4.0` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@mui/material` to `9.4.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4e737109f9169271", "name": "Dependency @mui/x-data-grid is two or more major versions behind", "shortDescription": {"text": "Dependency @mui/x-data-grid is two or more major versions behind"}, "fullDescription": {"text": "`@mui/x-data-grid` is pinned at `6.18.1` in `frontend/package.json` while the latest release on the npm registry is `9.14.0` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@mui/x-data-grid` to `9.14.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b020e9ef406fa09c", "name": "Dependency @mui/x-date-pickers is two or more major versions behind", "shortDescription": {"text": "Dependency @mui/x-date-pickers is two or more major versions behind"}, "fullDescription": {"text": "`@mui/x-date-pickers` is pinned at `6.18.1` in `frontend/package.json` while the latest release on the npm registry is `9.14.0` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@mui/x-date-pickers` to `9.14.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-66596a73e24bd758", "name": "Dependency @sentry/react is a major version behind", "shortDescription": {"text": "Dependency @sentry/react is a major version behind"}, "fullDescription": {"text": "`@sentry/react` is pinned at `9.28.1` in `frontend/package.json` while the latest release on the npm registry is `10.75.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@sentry/react` to `10.75.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-0770c72f6bf70d02", "name": "Dependency @sentry/vite-plugin is two or more major versions behind", "shortDescription": {"text": "Dependency @sentry/vite-plugin is two or more major versions behind"}, "fullDescription": {"text": "`@sentry/vite-plugin` is pinned at `3.5.0` in `frontend/package.json` while the latest release on the npm registry is `5.4.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@sentry/vite-plugin` to `5.4.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-86608f231884dc5f", "name": "Dependency @simplewebauthn/browser is a major version behind", "shortDescription": {"text": "Dependency @simplewebauthn/browser is a major version behind"}, "fullDescription": {"text": "`@simplewebauthn/browser` is pinned at `13.2.2` in `frontend/package.json` while the latest release on the npm registry is `14.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@simplewebauthn/browser` to `14.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-923d98bfbfbf7d8d", "name": "Dependency @stripe/stripe-js is two or more major versions behind", "shortDescription": {"text": "Dependency @stripe/stripe-js is two or more major versions behind"}, "fullDescription": {"text": "`@stripe/stripe-js` is pinned at `5.2.0` in `frontend/package.json` while the latest release on the npm registry is `9.16.0` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@stripe/stripe-js` to `9.16.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6dd8277728338642", "name": "Dependency @tanstack/react-table is a major version behind", "shortDescription": {"text": "Dependency @tanstack/react-table is a major version behind"}, "fullDescription": {"text": "`@tanstack/react-table` is pinned at `8.21.3` in `frontend/package.json` while the latest release on the npm registry is `9.2.4` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@tanstack/react-table` to `9.2.4`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d8c3929259cb295b", "name": "Dependency ag-grid-enterprise is a major version behind", "shortDescription": {"text": "Dependency ag-grid-enterprise is a major version behind"}, "fullDescription": {"text": "`ag-grid-enterprise` is pinned at `35.0.0` in `frontend/package.json` while the latest release on the npm registry is `36.2.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ag-grid-enterprise` to `36.2.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-a741c66c61271dfe", "name": "Dependency ag-grid-react is a major version behind", "shortDescription": {"text": "Dependency ag-grid-react is a major version behind"}, "fullDescription": {"text": "`ag-grid-react` is pinned at `35.0.0` in `frontend/package.json` while the latest release on the npm registry is `36.2.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ag-grid-react` to `36.2.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-a168356e3de444a7", "name": "Dependency apexcharts is two or more major versions behind", "shortDescription": {"text": "Dependency apexcharts is two or more major versions behind"}, "fullDescription": {"text": "`apexcharts` is pinned at `3.45.1` in `frontend/package.json` while the latest release on the npm registry is `7.4.0` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `apexcharts` to `7.4.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fc06f382df232e46", "name": "Dependency date-fns is two or more major versions behind", "shortDescription": {"text": "Dependency date-fns is two or more major versions behind"}, "fullDescription": {"text": "`date-fns` is pinned at `2.30.0` in `frontend/package.json` while the latest release on the npm registry is `4.4.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `date-fns` to `4.4.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-59f0eb187022855e", "name": "Dependency diff is a major version behind", "shortDescription": {"text": "Dependency diff is a major version behind"}, "fullDescription": {"text": "`diff` is pinned at `8.0.2` in `frontend/package.json` while the latest release on the npm registry is `9.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-f2cbd711667fdd01", "name": "Dependency express is a major version behind", "shortDescription": {"text": "Dependency express is a major version behind"}, "fullDescription": {"text": "`express` is pinned at `4.21.0` in `futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package.json` while the latest release on the npm registry is `5.2.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `express` to `5.2.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-70bfff7672e6cba8", "name": "589 backend endpoints not called by scanned frontend", "shortDescription": {"text": "589 backend endpoints not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: ANY /integrations/, ANY /integrations/connections, ANY /integrations/sync-logs, ANY /agent-playground/graphs/from-trace/, ANY /agent-playground/graphs/<uuid:pk>/versions/, ANY /agent-playground/graphs/<uuid:pk>/versions/<uuid:version_id>/, ANY /agent-playground/graphs/<uuid:pk>/versions/<uuid:version_id>/activate/, ANY /agent-playground/graphs/<uuid:graph_id>/dataset/ + 581 more. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30829"}, "properties": {"repository": "future-agi/future-agi", "repoUrl": "https://github.com/future-agi/future-agi", "branch": "main"}, "results": [{"ruleId": "scanner-6d24705a7d2e56a6", "level": "note", "message": {"text": "Possibly dead Python function: trigger_alert"}, "properties": {"repobilityId": "ccf00e2d27b70e2b", "scanner": "scanner-primary", "fingerprint": "6d24705a7d2e56a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/integrations/services/pagerduty_service.py:113"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f7f84e7c4026862", "level": "note", "message": {"text": "Possibly dead Python function: resolve_alert"}, "properties": {"repobilityId": "78d4f5797dcb8e56", "scanner": "scanner-primary", "fingerprint": "8f7f84e7c4026862", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/integrations/services/pagerduty_service.py:154"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e649b65d2a3968a3", "level": "note", "message": {"text": "Possibly dead Python function: identify_user"}, "properties": {"repobilityId": "01bc4bf349ab8d0a", "scanner": "scanner-primary", "fingerprint": "e649b65d2a3968a3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/analytics/posthog_util.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77328219c3dadd01", "level": "note", "message": {"text": "Possibly dead Python function: is_feature_enabled"}, "properties": {"repobilityId": "3cbf71746d6263e2", "scanner": "scanner-primary", "fingerprint": "77328219c3dadd01", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/analytics/posthog_util.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-437af83a1c2e5e70", "level": "note", "message": {"text": "Possibly dead Python function: validate_row_ids"}, "properties": {"repobilityId": "550dbf228c33f40a", "scanner": "scanner-primary", "fingerprint": "437af83a1c2e5e70", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/serializers/dataset_link.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02a2892d8b82d48f", "level": "note", "message": {"text": "Possibly dead Python function: validate_key"}, "properties": {"repobilityId": "dbeaa75fc4e1e499", "scanner": "scanner-primary", "fingerprint": "02a2892d8b82d48f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/serializers/node.py:159"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fa0a1fc947d8ae8b", "level": "note", "message": {"text": "Possibly dead Python function: validate_value"}, "properties": {"repobilityId": "b57365a1e36676e2", "scanner": "scanner-primary", "fingerprint": "fa0a1fc947d8ae8b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/serializers/node.py:167"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbcae357b215a7a7", "level": "note", "message": {"text": "Possibly dead Python function: validate_response_format"}, "properties": {"repobilityId": "41dee68fa07ef550", "scanner": "scanner-primary", "fingerprint": "dbcae357b215a7a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/serializers/node.py:357"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96c59650efbde64d", "level": "note", "message": {"text": "Possibly dead Python function: validate_name"}, "properties": {"repobilityId": "092f0afb84330c90", "scanner": "scanner-primary", "fingerprint": "96c59650efbde64d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/serializers/node.py:565"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9adb00be2caf92f", "level": "note", "message": {"text": "Possibly dead Python function: validate_input_mappings"}, "properties": {"repobilityId": "e3c28ff5a6570355", "scanner": "scanner-primary", "fingerprint": "b9adb00be2caf92f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/serializers/node.py:572"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23a23aa81ab9bcb6", "level": "note", "message": {"text": "Possibly dead Python function: build_input_payload"}, "properties": {"repobilityId": "439aa2b34dc880e7", "scanner": "scanner-primary", "fingerprint": "23a23aa81ab9bcb6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/services/dataset_bridge.py:207"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b7df1acc98f87b6", "level": "note", "message": {"text": "Possibly dead Python function: replacer"}, "properties": {"repobilityId": "4c6d041d83cc4187", "scanner": "scanner-primary", "fingerprint": "9b7df1acc98f87b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/services/engine/runners/llm_prompt.py:241"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4fdba0cf86df4d8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/utils/logger.js:64"}, "properties": {"repobilityId": "ae0a58671b6d0a9a", "scanner": "scanner-primary", "fingerprint": "b4fdba0cf86df4d8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/utils/logger.js"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-70e8fe84d16c1fbc", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/components/traceDetail/SpanDetailPane.jsx:120"}, "properties": {"repobilityId": "c3bd414bdd538f0d", "scanner": "scanner-primary", "fingerprint": "70e8fe84d16c1fbc", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/traceDetail/SpanDetailPane.jsx"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-8277fe55a49a64fd", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/components/imagine/widgets/WidgetMarkdown.jsx:75"}, "properties": {"repobilityId": "9dd1e4a959f1bdc7", "scanner": "scanner-primary", "fingerprint": "8277fe55a49a64fd", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/imagine/widgets/WidgetMarkdown.jsx"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-8129e55074c06c16", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx:2363"}, "properties": {"repobilityId": "2c95ee5cfa900792", "scanner": "scanner-primary", "fingerprint": "8129e55074c06c16", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx"}, "region": {"startLine": 2363}}}]}, {"ruleId": "scanner-e8c5196d861ad4d9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/workbench-v2/components/PromptItem.jsx:327"}, "properties": {"repobilityId": "f2c1c329e2b834d8", "scanner": "scanner-primary", "fingerprint": "e8c5196d861ad4d9", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/workbench-v2/components/PromptItem.jsx"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-a699bd68c2660e89", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/scenarios/CreateScenarioView.jsx:506"}, "properties": {"repobilityId": "703439fefc82fc65", "scanner": "scanner-primary", "fingerprint": "a699bd68c2660e89", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/scenarios/CreateScenarioView.jsx"}, "region": {"startLine": 506}}}]}, {"ruleId": "scanner-76130287cee69810", "level": "warning", "message": {"text": "Custom React Flow node registered without explicit width/height \u2014 frontend/src/sections/agent-playground/utils/__tests__/workflowValidation.test.js:154"}, "properties": {"repobilityId": "4307ab1f776c89d7", "scanner": "scanner-primary", "fingerprint": "76130287cee69810", "layer": "frontend", "severity": "medium", "confidence": 0.85, "tags": ["frontend-quality", "fq.rfnode.no-dims"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agent-playground/utils/__tests__/workflowValidation.test.js"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-7fc358e20750272d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariableDrawer.jsx:37"}, "properties": {"repobilityId": "c4d80fe4be326236", "scanner": "scanner-primary", "fingerprint": "7fc358e20750272d", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariableDrawer.jsx"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-b7a8cbf1b2248a3e", "level": "warning", "message": {"text": "Custom React Flow node registered without explicit width/height \u2014 frontend/src/sections/agent-playground/Overview/__tests__/OverviewGraphPreview.test.jsx:43"}, "properties": {"repobilityId": "7937f39869587b13", "scanner": "scanner-primary", "fingerprint": "b7a8cbf1b2248a3e", "layer": "frontend", "severity": "medium", "confidence": 0.85, "tags": ["frontend-quality", "fq.rfnode.no-dims"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agent-playground/Overview/__tests__/OverviewGraphPreview.test.jsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-b7eea64b4cd7edd3", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/layouts/common/notifications-popover/notification-item.jsx:260"}, "properties": {"repobilityId": "aa2e5337ccab7631", "scanner": "scanner-primary", "fingerprint": "b7eea64b4cd7edd3", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/layouts/common/notifications-popover/notification-item.jsx"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-5d2721b32a2fc1a5", "level": "warning", "message": {"text": "math random used \u2014 agentcc-gateway/internal/middleware/requestid.go:4"}, "properties": {"repobilityId": "bdb8a9c2f91240d8", "scanner": "scanner-primary", "fingerprint": "5d2721b32a2fc1a5", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/middleware/requestid.go"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-8dd39fc173f96735", "level": "warning", "message": {"text": "math random used \u2014 agentcc-gateway/internal/routing/adaptive.go:5"}, "properties": {"repobilityId": "9acb366b1da3ae93", "scanner": "scanner-primary", "fingerprint": "8dd39fc173f96735", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/routing/adaptive.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-75129616e02ba1ca", "level": "warning", "message": {"text": "math random used \u2014 agentcc-gateway/internal/routing/mirror.go:9"}, "properties": {"repobilityId": "f6bbe25c852598f9", "scanner": "scanner-primary", "fingerprint": "75129616e02ba1ca", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/routing/mirror.go"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-b0fa10e39c2e87f7", "level": "warning", "message": {"text": "math random used \u2014 agentcc-gateway/internal/routing/retry.go:7"}, "properties": {"repobilityId": "bff6fe51578cf8ee", "scanner": "scanner-primary", "fingerprint": "b0fa10e39c2e87f7", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/routing/retry.go"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-39e119291a63fbfc", "level": "warning", "message": {"text": "math random used \u2014 agentcc-gateway/internal/routing/weighted.go:5"}, "properties": {"repobilityId": "bbb2775f89bf1a13", "scanner": "scanner-primary", "fingerprint": "39e119291a63fbfc", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/routing/weighted.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e76cbf06fb4c9098", "level": "warning", "message": {"text": "math random used \u2014 fi-collector/cmd/loadgen/fabricate.go:5"}, "properties": {"repobilityId": "1b5d90ba1f59fbd5", "scanner": "scanner-primary", "fingerprint": "e76cbf06fb4c9098", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fi-collector/cmd/loadgen/fabricate.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e363f4b95b876590", "level": "warning", "message": {"text": "math random used \u2014 fi-collector/cmd/loadgen/main.go:13"}, "properties": {"repobilityId": "0844799a6bb0617c", "scanner": "scanner-primary", "fingerprint": "e363f4b95b876590", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fi-collector/cmd/loadgen/main.go"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-676be582b106edca", "level": "warning", "message": {"text": "math random used \u2014 fi-collector/pkg/chwriter/writer.go:29"}, "properties": {"repobilityId": "f744675fd23925e5", "scanner": "scanner-primary", "fingerprint": "676be582b106edca", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fi-collector/pkg/chwriter/writer.go"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-321b765db7187e80", "level": "warning", "message": {"text": "header redefinition \u2014 frontend/nginx.conf:42"}, "properties": {"repobilityId": "806699c40de42fc6", "scanner": "scanner-primary", "fingerprint": "321b765db7187e80", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "nginx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/nginx.conf"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-69918f8dad9529a9", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/components/imagine/widgets/WidgetMarkdown.jsx:75"}, "properties": {"repobilityId": "12f27cc2f5d3d1d6", "scanner": "scanner-primary", "fingerprint": "69918f8dad9529a9", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/imagine/widgets/WidgetMarkdown.jsx"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-fefdae1fc1cd5a59", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/components/traceDetail/SpanDetailPane.jsx:120"}, "properties": {"repobilityId": "acec4da0ebec4fdb", "scanner": "scanner-primary", "fingerprint": "fefdae1fc1cd5a59", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/traceDetail/SpanDetailPane.jsx"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-91a7875d99a444fa", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/layouts/common/notifications-popover/notification-item.jsx:260"}, "properties": {"repobilityId": "499377d2ce135216", "scanner": "scanner-primary", "fingerprint": "91a7875d99a444fa", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/layouts/common/notifications-popover/notification-item.jsx"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-4c880cf3087df3e9", "level": "warning", "message": {"text": "unvalidated password \u2014 futureagi/accounts/models/user.py:23"}, "properties": {"repobilityId": "86ef11dd642ded36", "scanner": "scanner-primary", "fingerprint": "4c880cf3087df3e9", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/models/user.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-5511b710f57bd46f", "level": "warning", "message": {"text": "template unescaped with safe \u2014 futureagi/accounts/templates/saml2_auth/login.html:15"}, "properties": {"repobilityId": "4f91b65646fcec19", "scanner": "scanner-primary", "fingerprint": "5511b710f57bd46f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "flask"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/templates/saml2_auth/login.html"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-58663cfcdf720d75", "level": "warning", "message": {"text": "unvalidated password \u2014 futureagi/accounts/views/appsmith.py:87"}, "properties": {"repobilityId": "5fabbe5a40c53cfc", "scanner": "scanner-primary", "fingerprint": "58663cfcdf720d75", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/appsmith.py"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-25947adbde8bbfd5", "level": "warning", "message": {"text": "unvalidated password \u2014 futureagi/accounts/views/workspace.py:383"}, "properties": {"repobilityId": "73b0597d12707e2f", "scanner": "scanner-primary", "fingerprint": "25947adbde8bbfd5", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/workspace.py"}, "region": {"startLine": 383}}}]}, {"ruleId": "scanner-710b21cfbcb75470", "level": "warning", "message": {"text": "unvalidated password \u2014 futureagi/accounts/views/workspace_management.py:584"}, "properties": {"repobilityId": "5a22c37a99b01062", "scanner": "scanner-primary", "fingerprint": "710b21cfbcb75470", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/workspace_management.py"}, "region": {"startLine": 584}}}]}, {"ruleId": "scanner-ffafa7bbe34ea157", "level": "warning", "message": {"text": "use defused xml \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/functions.py:2282"}, "properties": {"repobilityId": "7f3d629b87774c10", "scanner": "scanner-primary", "fingerprint": "ffafa7bbe34ea157", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/fi_evals/function/functions.py"}, "region": {"startLine": 2282}}}]}, {"ruleId": "scanner-e6ba3f3f699db541", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 futureagi/agentic_eval/core_evals/fi_evals/llm/custom_prompt_evaluator/file_processor.py:117"}, "properties": {"repobilityId": "0fee739193dd246c", "scanner": "scanner-primary", "fingerprint": "e6ba3f3f699db541", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/fi_evals/llm/custom_prompt_evaluator/file_processor.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-ea3ed84f647e7f00", "level": "warning", "message": {"text": "exec detected \u2014 futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py:257"}, "properties": {"repobilityId": "cbf00e85a0a26284", "scanner": "scanner-primary", "fingerprint": "ea3ed84f647e7f00", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-5f186e135538890b", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 futureagi/agentic_eval/core_evals/fi_utils/sandbox.py:474"}, "properties": {"repobilityId": "4ff31cbff9d71a2b", "scanner": "scanner-primary", "fingerprint": "5f186e135538890b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/fi_utils/sandbox.py"}, "region": {"startLine": 474}}}]}, {"ruleId": "scanner-c6fb234579f97a05", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 futureagi/bin/install_nltk_data.py:57"}, "properties": {"repobilityId": "d613fa4fd6bf3881", "scanner": "scanner-primary", "fingerprint": "c6fb234579f97a05", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/bin/install_nltk_data.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-87df2f65b1645736", "level": "warning", "message": {"text": "insecure hash algorithm sha1 \u2014 futureagi/ee/agenthub/traceerroragent/memory.py:150"}, "properties": {"repobilityId": "a7be3bca27a78acf", "scanner": "scanner-primary", "fingerprint": "87df2f65b1645736", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/agenthub/traceerroragent/memory.py"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-1452f6cbfbac4891", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 futureagi/ee/evals/llm/agent_evaluator/evaluator.py:395"}, "properties": {"repobilityId": "d40f08554236a4d7", "scanner": "scanner-primary", "fingerprint": "1452f6cbfbac4891", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/evals/llm/agent_evaluator/evaluator.py"}, "region": {"startLine": 395}}}]}, {"ruleId": "scanner-a3a6f20ba50eb4a5", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 futureagi/ee/evals/llm/custom_prompt_evaluator/file_processor.py:117"}, "properties": {"repobilityId": "3b5a1f509f16c500", "scanner": "scanner-primary", "fingerprint": "a3a6f20ba50eb4a5", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/evals/llm/custom_prompt_evaluator/file_processor.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-8e51931d66effe78", "level": "warning", "message": {"text": "var in href \u2014 futureagi/model_hub/templates/annotation_daily_digest.html:55"}, "properties": {"repobilityId": "fdc5b04ab1d30d92", "scanner": "scanner-primary", "fingerprint": "8e51931d66effe78", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "html-templates"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/templates/annotation_daily_digest.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-9af3cd00d933b4c1", "level": "warning", "message": {"text": "var in href \u2014 futureagi/model_hub/templates/annotation_realtime_digest.html:55"}, "properties": {"repobilityId": "029ae9afd42f946d", "scanner": "scanner-primary", "fingerprint": "9af3cd00d933b4c1", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "html-templates"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/templates/annotation_realtime_digest.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-58130fcc5ee991cf", "level": "warning", "message": {"text": "extends custom expression \u2014 futureagi/model_hub/utils/eval_list.py:474"}, "properties": {"repobilityId": "18e8c5c27d6c0127", "scanner": "scanner-primary", "fingerprint": "58130fcc5ee991cf", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/utils/eval_list.py"}, "region": {"startLine": 474}}}]}, {"ruleId": "scanner-5c932fc6c4d62ebf", "level": "warning", "message": {"text": "avoid query set extra \u2014 futureagi/simulate/utils/persona_filtering.py:131"}, "properties": {"repobilityId": "569dac50ed3a5c5c", "scanner": "scanner-primary", "fingerprint": "5c932fc6c4d62ebf", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/utils/persona_filtering.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-040538a0fe39de0b", "level": "warning", "message": {"text": "avoid query set extra \u2014 futureagi/simulate/utils/test_execution_utils.py:163"}, "properties": {"repobilityId": "dc8c22ec464a4652", "scanner": "scanner-primary", "fingerprint": "040538a0fe39de0b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/utils/test_execution_utils.py"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-c86ba97bc104b5eb", "level": "warning", "message": {"text": "template unescaped with safe \u2014 futureagi/tfc/templates/admin/usage/custom_pricing.html:201"}, "properties": {"repobilityId": "4b6165c3c25b5844", "scanner": "scanner-primary", "fingerprint": "c86ba97bc104b5eb", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "flask"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/templates/admin/usage/custom_pricing.html"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-225eef821628cdc8", "level": "warning", "message": {"text": "template unescaped with safe \u2014 futureagi/tfc/templates/admin/usage/generate_invoice.html:111"}, "properties": {"repobilityId": "c64f083329e29827", "scanner": "scanner-primary", "fingerprint": "225eef821628cdc8", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "flask"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/templates/admin/usage/generate_invoice.html"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-68651a569a7486f0", "level": "error", "message": {"text": "http not https connection \u2014 futureagi/tfc/utils/ssrf_guard.py:136"}, "properties": {"repobilityId": "14984ddb7e0e9a7a", "scanner": "scanner-primary", "fingerprint": "68651a569a7486f0", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/utils/ssrf_guard.py"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-2d711b7f879320b3", "level": "warning", "message": {"text": "avoid raw sql \u2014 futureagi/tracer/queries/projects.py:41"}, "properties": {"repobilityId": "ea8c9b2c7ae366b9", "scanner": "scanner-primary", "fingerprint": "2d711b7f879320b3", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/queries/projects.py"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-18a688d59f6e619c", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 futureagi/tracer/services/clickhouse/v2/catalog_dev_schema.py:156"}, "properties": {"repobilityId": "ab10c6a87b29a79b", "scanner": "scanner-primary", "fingerprint": "18a688d59f6e619c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/services/clickhouse/v2/catalog_dev_schema.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-6ba6e3a8e092ad6e", "level": "warning", "message": {"text": "extends custom expression \u2014 futureagi/tracer/views/eval_task.py:92"}, "properties": {"repobilityId": "b391b205c3500ba4", "scanner": "scanner-primary", "fingerprint": "6ba6e3a8e092ad6e", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "django"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/eval_task.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-7973be9f3af266ff", "level": "error", "message": {"text": "CVE-2026-33815: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "78d0bcc8ba79a0d7", "scanner": "scanner-primary", "fingerprint": "7973be9f3af266ff", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33815"]}}, {"ruleId": "scanner-ce8e0245444a7e3a", "level": "error", "message": {"text": "CVE-2026-33816: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "bdb532ff80a57d3d", "scanner": "scanner-primary", "fingerprint": "ce8e0245444a7e3a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33816"]}}, {"ruleId": "scanner-4522dfc9e115378f", "level": "note", "message": {"text": "CVE-2026-41889: github.com/jackc/pgx/v5 v5.7.4 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "c77c487928dd4e57", "scanner": "scanner-primary", "fingerprint": "4522dfc9e115378f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41889"]}}, {"ruleId": "scanner-86c14f9eaf140ad1", "level": "error", "message": {"text": "CVE-2026-39828: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "bd091a90e9050953", "scanner": "scanner-primary", "fingerprint": "86c14f9eaf140ad1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39828"]}}, {"ruleId": "scanner-376fecfed35459ff", "level": "error", "message": {"text": "CVE-2026-39829: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "4f820dffeafa1d5d", "scanner": "scanner-primary", "fingerprint": "376fecfed35459ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39829"]}}, {"ruleId": "scanner-1d24e9bc533bf603", "level": "error", "message": {"text": "CVE-2026-39830: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "73ca9ae4318c217c", "scanner": "scanner-primary", "fingerprint": "1d24e9bc533bf603", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39830"]}}, {"ruleId": "scanner-4735d1a5ccce051d", "level": "error", "message": {"text": "CVE-2026-39831: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "8184c9c4f840cec1", "scanner": "scanner-primary", "fingerprint": "4735d1a5ccce051d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39831"]}}, {"ruleId": "scanner-83150d2dad5849f3", "level": "error", "message": {"text": "CVE-2026-39832: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "a6734cb32eced44f", "scanner": "scanner-primary", "fingerprint": "83150d2dad5849f3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39832"]}}, {"ruleId": "scanner-7e6833d836ba0314", "level": "error", "message": {"text": "CVE-2026-39835: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "58e9e2b9e2331226", "scanner": "scanner-primary", "fingerprint": "7e6833d836ba0314", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39835"]}}, {"ruleId": "scanner-929a6f2d4c496d8f", "level": "error", "message": {"text": "CVE-2026-42508: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "6fa2860d43e13619", "scanner": "scanner-primary", "fingerprint": "929a6f2d4c496d8f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42508"]}}, {"ruleId": "scanner-9699ca60e01cce8c", "level": "error", "message": {"text": "CVE-2026-46595: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "f9b33cb4de1a3688", "scanner": "scanner-primary", "fingerprint": "9699ca60e01cce8c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46595"]}}, {"ruleId": "scanner-56b0ae3b4e4bd754", "level": "error", "message": {"text": "CVE-2026-46597: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "7a7e2973fa0965c5", "scanner": "scanner-primary", "fingerprint": "56b0ae3b4e4bd754", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46597"]}}, {"ruleId": "scanner-610d0551627b33ca", "level": "error", "message": {"text": "CVE-2026-56854: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "8e14cfede6f47055", "scanner": "scanner-primary", "fingerprint": "610d0551627b33ca", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56854"]}}, {"ruleId": "scanner-0e4e8746747d33a8", "level": "warning", "message": {"text": "CVE-2026-39827: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "c76d374f96eeffac", "scanner": "scanner-primary", "fingerprint": "0e4e8746747d33a8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39827"]}}, {"ruleId": "scanner-11333d7022d30086", "level": "warning", "message": {"text": "CVE-2026-39833: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "97e9206e78b32f89", "scanner": "scanner-primary", "fingerprint": "11333d7022d30086", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39833"]}}, {"ruleId": "scanner-f10b282602cad725", "level": "warning", "message": {"text": "CVE-2026-39834: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "3ed6ea5c8e64b6a3", "scanner": "scanner-primary", "fingerprint": "f10b282602cad725", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39834"]}}, {"ruleId": "scanner-16b4de74ff4b8272", "level": "warning", "message": {"text": "CVE-2026-46598: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "93966c3bb9e49bbf", "scanner": "scanner-primary", "fingerprint": "16b4de74ff4b8272", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46598"]}}, {"ruleId": "scanner-c6648dffd04dfd15", "level": "warning", "message": {"text": "CVE-2026-56855: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "4dcaa28adee65b4b", "scanner": "scanner-primary", "fingerprint": "c6648dffd04dfd15", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56855"]}}, {"ruleId": "scanner-9be5651889708f23", "level": "warning", "message": {"text": "CVE-2026-78662: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "07661ef1b4a53b4f", "scanner": "scanner-primary", "fingerprint": "9be5651889708f23", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78662"]}}, {"ruleId": "scanner-d566592d38a06502", "level": "none", "message": {"text": "GO-2026-5932: golang.org/x/crypto v0.48.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "7e8bcda210c77376", "scanner": "scanner-primary", "fingerprint": "d566592d38a06502", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "GO-2026-5932"]}}, {"ruleId": "scanner-ff5c0276bdcf4f0b", "level": "error", "message": {"text": "CVE-2026-25681: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "a0ffba2723bfee2d", "scanner": "scanner-primary", "fingerprint": "ff5c0276bdcf4f0b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25681"]}}, {"ruleId": "scanner-14a3047322e409e4", "level": "error", "message": {"text": "CVE-2026-27136: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "bdbee7401f128ea7", "scanner": "scanner-primary", "fingerprint": "14a3047322e409e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27136"]}}, {"ruleId": "scanner-210cea3f4a797c32", "level": "error", "message": {"text": "CVE-2026-33814: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "752b6b58047f6be0", "scanner": "scanner-primary", "fingerprint": "210cea3f4a797c32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33814"]}}, {"ruleId": "scanner-aac2a6590f964f07", "level": "error", "message": {"text": "CVE-2026-39821: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "80aa704df7d1a85b", "scanner": "scanner-primary", "fingerprint": "aac2a6590f964f07", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39821"]}}, {"ruleId": "scanner-2eb7520952ab6402", "level": "error", "message": {"text": "CVE-2026-46600: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "a18a6f086c892b60", "scanner": "scanner-primary", "fingerprint": "2eb7520952ab6402", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46600"]}}, {"ruleId": "scanner-cdefc7f40c6e8513", "level": "warning", "message": {"text": "CVE-2026-25680: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "dde787dc4194cf24", "scanner": "scanner-primary", "fingerprint": "cdefc7f40c6e8513", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25680"]}}, {"ruleId": "scanner-aa9e84a6d5433330", "level": "warning", "message": {"text": "CVE-2026-42502: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "f2ce2e6fdce58a2f", "scanner": "scanner-primary", "fingerprint": "aa9e84a6d5433330", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42502"]}}, {"ruleId": "scanner-8b174eb905f6eeb1", "level": "warning", "message": {"text": "CVE-2026-42506: golang.org/x/net v0.49.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "6c66f31b7e8cdb46", "scanner": "scanner-primary", "fingerprint": "8b174eb905f6eeb1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42506"]}}, {"ruleId": "scanner-04db8ba0fa5dc2bc", "level": "none", "message": {"text": "CVE-2026-39824: golang.org/x/sys v0.41.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "1da8c78e954d3f8e", "scanner": "scanner-primary", "fingerprint": "04db8ba0fa5dc2bc", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39824"]}}, {"ruleId": "scanner-dc14cc056d111770", "level": "error", "message": {"text": "CVE-2026-56852: golang.org/x/text v0.34.0 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "f89ae00e007d5f33", "scanner": "scanner-primary", "fingerprint": "dc14cc056d111770", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56852"]}}, {"ruleId": "scanner-41f65262a1b66b31", "level": "error", "message": {"text": "CVE-2026-33186: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "b9545e39ae3fcb3f", "scanner": "scanner-primary", "fingerprint": "41f65262a1b66b31", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33186"]}}, {"ruleId": "scanner-5af9a8d1e930f2b4", "level": "error", "message": {"text": "CVE-2026-84304: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "93f30188a8e1dbf7", "scanner": "scanner-primary", "fingerprint": "5af9a8d1e930f2b4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84304"]}}, {"ruleId": "scanner-1bd13534518539c3", "level": "error", "message": {"text": "CVE-2026-84445: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "1ae8fbea5eeabe31", "scanner": "scanner-primary", "fingerprint": "1bd13534518539c3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84445"]}}, {"ruleId": "scanner-283886efdc2ea200", "level": "error", "message": {"text": "GHSA-hrxh-6v49-42gf: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "92586f37b00a81b1", "scanner": "scanner-primary", "fingerprint": "283886efdc2ea200", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-hrxh-6v49-42gf"]}}, {"ruleId": "scanner-2818d23f53bf3de2", "level": "warning", "message": {"text": "CVE-2026-84303: google.golang.org/grpc v1.67.1 \u2014 fi-collector/go.mod"}, "properties": {"repobilityId": "788419235c43eb22", "scanner": "scanner-primary", "fingerprint": "2818d23f53bf3de2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84303"]}}, {"ruleId": "scanner-08d10c60d1734d38", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3f8608b005d7a815", "scanner": "scanner-primary", "fingerprint": "08d10c60d1734d38", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-2c22e606ca292f18", "level": "warning", "message": {"text": "CVE-2025-27789: @babel/runtime 7.24.6 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "ca7b8e936b4110f4", "scanner": "scanner-primary", "fingerprint": "2c22e606ca292f18", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27789"]}}, {"ruleId": "scanner-43ee72f334e57cf0", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 2.2.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "ff92f1245d0ff883", "scanner": "scanner-primary", "fingerprint": "43ee72f334e57cf0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-86b6350d9bdcc423", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 2.6.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "ff92f1245d0ff883", "scanner": "scanner-primary", "fingerprint": "86b6350d9bdcc423", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-7b0462786256cbdf", "level": "warning", "message": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "6438874d1ee5b113", "scanner": "scanner-primary", "fingerprint": "7b0462786256cbdf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-152614caaba55157", "level": "error", "message": {"text": "CVE-2026-22029: @remix-run/router 1.9.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "7bea21fc0681fe3d", "scanner": "scanner-primary", "fingerprint": "152614caaba55157", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22029"]}}, {"ruleId": "scanner-2934cb75d325ca5b", "level": "warning", "message": {"text": "CVE-2026-40181: @remix-run/router 1.9.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "30b7e74508ffa6eb", "scanner": "scanner-primary", "fingerprint": "2934cb75d325ca5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40181"]}}, {"ruleId": "scanner-786bd0f029d682b5", "level": "error", "message": {"text": "CVE-2024-39338: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "5126c6f60bfe0e20", "scanner": "scanner-primary", "fingerprint": "786bd0f029d682b5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-39338"]}}, {"ruleId": "scanner-e173ac9b0e1358e0", "level": "error", "message": {"text": "CVE-2025-27152: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "89b3279d527f451c", "scanner": "scanner-primary", "fingerprint": "e173ac9b0e1358e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27152"]}}, {"ruleId": "scanner-b855297209f5f210", "level": "error", "message": {"text": "CVE-2025-58754: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "e0b6e259cc3d7f67", "scanner": "scanner-primary", "fingerprint": "b855297209f5f210", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-58754"]}}, {"ruleId": "scanner-100695dba2b20258", "level": "error", "message": {"text": "CVE-2026-25639: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "dd8e58ba469eb41b", "scanner": "scanner-primary", "fingerprint": "100695dba2b20258", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-56b2f7e93c8fd20c", "level": "error", "message": {"text": "CVE-2026-42033: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4f2a47a94adaa0f5", "scanner": "scanner-primary", "fingerprint": "56b2f7e93c8fd20c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-02e9ef80522b683a", "level": "error", "message": {"text": "CVE-2026-42035: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "f1e519bde6311316", "scanner": "scanner-primary", "fingerprint": "02e9ef80522b683a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-d4985ddf640d03d3", "level": "error", "message": {"text": "CVE-2026-42043: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "8799f5de96ae640d", "scanner": "scanner-primary", "fingerprint": "d4985ddf640d03d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-eb98af8372447547", "level": "error", "message": {"text": "CVE-2026-42264: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "c4a9dd6d432a81b3", "scanner": "scanner-primary", "fingerprint": "eb98af8372447547", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42264"]}}, {"ruleId": "scanner-5e8e67511fab1e72", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3d488c3ba433aee7", "scanner": "scanner-primary", "fingerprint": "5e8e67511fab1e72", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-2d8adae695151795", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4738511cceab2350", "scanner": "scanner-primary", "fingerprint": "2d8adae695151795", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-ad909d76f4abc827", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a82c142bdc3c3ed8", "scanner": "scanner-primary", "fingerprint": "ad909d76f4abc827", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-21d20849e290ee4e", "level": "error", "message": {"text": "CVE-2026-44495: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "9b5ed56d8c3f8a55", "scanner": "scanner-primary", "fingerprint": "21d20849e290ee4e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-e94a88bc10c4484f", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "491c88f795dcb0a0", "scanner": "scanner-primary", "fingerprint": "e94a88bc10c4484f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-a1f54a33944a15a9", "level": "warning", "message": {"text": "CVE-2023-45857: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3476f4bd9a333dbe", "scanner": "scanner-primary", "fingerprint": "a1f54a33944a15a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-45857"]}}, {"ruleId": "scanner-8d8a5db339bd53d0", "level": "warning", "message": {"text": "CVE-2025-62718: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "b615220f79ae9144", "scanner": "scanner-primary", "fingerprint": "8d8a5db339bd53d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-55a0c452286da702", "level": "warning", "message": {"text": "CVE-2026-40175: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "145abc8f743ed010", "scanner": "scanner-primary", "fingerprint": "55a0c452286da702", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-3813a648bfd6d214", "level": "warning", "message": {"text": "CVE-2026-42034: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "d516949da99beef2", "scanner": "scanner-primary", "fingerprint": "3813a648bfd6d214", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-a453d9ccf871ca6b", "level": "warning", "message": {"text": "CVE-2026-42036: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "0f1929df4b2ff2c7", "scanner": "scanner-primary", "fingerprint": "a453d9ccf871ca6b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-edfc51855a96df2b", "level": "warning", "message": {"text": "CVE-2026-42037: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "cfbd91fc7752080c", "scanner": "scanner-primary", "fingerprint": "edfc51855a96df2b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42037"]}}, {"ruleId": "scanner-624300467a1bf103", "level": "warning", "message": {"text": "CVE-2026-42038: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "5de06aa0fd420f2a", "scanner": "scanner-primary", "fingerprint": "624300467a1bf103", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-98a5188445a92a06", "level": "warning", "message": {"text": "CVE-2026-42039: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "52f775fe8eb4a5c2", "scanner": "scanner-primary", "fingerprint": "98a5188445a92a06", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-b877fc75552f6097", "level": "warning", "message": {"text": "CVE-2026-42041: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "54c9b9e13cf0cc9d", "scanner": "scanner-primary", "fingerprint": "b877fc75552f6097", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-bd87d9293e7b2769", "level": "warning", "message": {"text": "CVE-2026-42042: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3645b896019f6f8a", "scanner": "scanner-primary", "fingerprint": "bd87d9293e7b2769", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-c358d2f39e527467", "level": "warning", "message": {"text": "CVE-2026-42044: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "9c0ada8fd916d8e6", "scanner": "scanner-primary", "fingerprint": "c358d2f39e527467", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42044"]}}, {"ruleId": "scanner-16b27123e6301dc6", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4cf287b88b31634c", "scanner": "scanner-primary", "fingerprint": "16b27123e6301dc6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-c7fcd024adac37a3", "level": "warning", "message": {"text": "CVE-2026-67312: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3cf26e8157440ee0", "scanner": "scanner-primary", "fingerprint": "c7fcd024adac37a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67312"]}}, {"ruleId": "scanner-748a95aae39cf355", "level": "warning", "message": {"text": "CVE-2026-67313: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "0e7d7068e5cde73c", "scanner": "scanner-primary", "fingerprint": "748a95aae39cf355", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67313"]}}, {"ruleId": "scanner-60563ce0990085c6", "level": "warning", "message": {"text": "CVE-2026-67316: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "e3753dbbc90b5b34", "scanner": "scanner-primary", "fingerprint": "60563ce0990085c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67316"]}}, {"ruleId": "scanner-f960ea4c01d0048b", "level": "warning", "message": {"text": "CVE-2026-67319: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3412eedfe8535d5b", "scanner": "scanner-primary", "fingerprint": "f960ea4c01d0048b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67319"]}}, {"ruleId": "scanner-dff5f3887c87580e", "level": "note", "message": {"text": "CVE-2026-42040: axios 1.5.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2fb26801d8d0cfcb", "scanner": "scanner-primary", "fingerprint": "dff5f3887c87580e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-73cd0946e9ad6f86", "level": "warning", "message": {"text": "CVE-2026-45819: baseline-browser-mapping 2.10.16 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "d6ceafa55d46962f", "scanner": "scanner-primary", "fingerprint": "73cd0946e9ad6f86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45819"]}}, {"ruleId": "scanner-6d347c181b5c7b17", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "1b167da6cf9297d4", "scanner": "scanner-primary", "fingerprint": "6d347c181b5c7b17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-8c6f62058478dec2", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a0c8285080de244c", "scanner": "scanner-primary", "fingerprint": "8c6f62058478dec2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-8ae8d292c7c986ff", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4aec133f95a9de31", "scanner": "scanner-primary", "fingerprint": "8ae8d292c7c986ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-3ebc362d18f81f01", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "d10bd2a9fe247e87", "scanner": "scanner-primary", "fingerprint": "3ebc362d18f81f01", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-523e7820e463014a", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2f270db29b00c7c1", "scanner": "scanner-primary", "fingerprint": "523e7820e463014a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-cbb26c38aeae0c37", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "1b167da6cf9297d4", "scanner": "scanner-primary", "fingerprint": "cbb26c38aeae0c37", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-c588ff13dcd24125", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a0c8285080de244c", "scanner": "scanner-primary", "fingerprint": "c588ff13dcd24125", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-058c7dd145941f5e", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4aec133f95a9de31", "scanner": "scanner-primary", "fingerprint": "058c7dd145941f5e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-6e6575201f24d8c4", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "d10bd2a9fe247e87", "scanner": "scanner-primary", "fingerprint": "6e6575201f24d8c4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-f69918bfd06aa8ba", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2f270db29b00c7c1", "scanner": "scanner-primary", "fingerprint": "f69918bfd06aa8ba", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-2f122e2fca846811", "level": "error", "message": {"text": "CVE-2026-73088: browserslist 4.28.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "67783790cfbbd76b", "scanner": "scanner-primary", "fingerprint": "2f122e2fca846811", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73088"]}}, {"ruleId": "scanner-3a105a3350cfc4ec", "level": "error", "message": {"text": "CVE-2026-73089: browserslist 4.28.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "f437320121493858", "scanner": "scanner-primary", "fingerprint": "3a105a3350cfc4ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73089"]}}, {"ruleId": "scanner-4094828578c767cd", "level": "warning", "message": {"text": "CVE-2026-41238: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "8c297142df10ee51", "scanner": "scanner-primary", "fingerprint": "4094828578c767cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41238"]}}, {"ruleId": "scanner-10357469cd81aca4", "level": "warning", "message": {"text": "CVE-2026-41239: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "9dd9f9088af15510", "scanner": "scanner-primary", "fingerprint": "10357469cd81aca4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41239"]}}, {"ruleId": "scanner-b7091aeaa2153514", "level": "warning", "message": {"text": "CVE-2026-41240: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a58bcf9152cb9c78", "scanner": "scanner-primary", "fingerprint": "b7091aeaa2153514", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41240"]}}, {"ruleId": "scanner-6f5082fe816cf6af", "level": "warning", "message": {"text": "CVE-2026-49458: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "acf7ada3e2b8e804", "scanner": "scanner-primary", "fingerprint": "6f5082fe816cf6af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49458"]}}, {"ruleId": "scanner-fb3904bcb935c33c", "level": "warning", "message": {"text": "CVE-2026-49459: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2e5b78506d3768bb", "scanner": "scanner-primary", "fingerprint": "fb3904bcb935c33c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49459"]}}, {"ruleId": "scanner-c03436c3a2c3d4a6", "level": "warning", "message": {"text": "CVE-2026-49978: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "09fcc4d31a6ca990", "scanner": "scanner-primary", "fingerprint": "c03436c3a2c3d4a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49978"]}}, {"ruleId": "scanner-0094635c9c5f20bd", "level": "warning", "message": {"text": "CVE-2026-65898: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "92fccc0f1f0edeae", "scanner": "scanner-primary", "fingerprint": "0094635c9c5f20bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65898"]}}, {"ruleId": "scanner-bc05d34b07142d88", "level": "warning", "message": {"text": "CVE-2026-65902: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "96eacb85bf87cfad", "scanner": "scanner-primary", "fingerprint": "bc05d34b07142d88", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65902"]}}, {"ruleId": "scanner-1f26dde6c55abde8", "level": "warning", "message": {"text": "CVE-2026-65903: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2bd2297428bc6f69", "scanner": "scanner-primary", "fingerprint": "1f26dde6c55abde8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65903"]}}, {"ruleId": "scanner-98f642e36e5eb776", "level": "warning", "message": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "92fe2f59951d3103", "scanner": "scanner-primary", "fingerprint": "98f642e36e5eb776", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-55q2-fjhq-7xh7"]}}, {"ruleId": "scanner-4c319932ac134ca8", "level": "note", "message": {"text": "CVE-2026-65899: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "aa40f4064b51c374", "scanner": "scanner-primary", "fingerprint": "4c319932ac134ca8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65899"]}}, {"ruleId": "scanner-20e946199ce73515", "level": "note", "message": {"text": "CVE-2026-65900: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "6712662ad94305cc", "scanner": "scanner-primary", "fingerprint": "20e946199ce73515", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65900"]}}, {"ruleId": "scanner-6a83a4d39b327ca7", "level": "note", "message": {"text": "CVE-2026-65901: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "b1559c667ad37c2c", "scanner": "scanner-primary", "fingerprint": "6a83a4d39b327ca7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65901"]}}, {"ruleId": "scanner-29dd7bfaa11730d9", "level": "note", "message": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.3.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "feddba8535cad074", "scanner": "scanner-primary", "fingerprint": "29dd7bfaa11730d9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-c2j3-45gr-mqc4"]}}, {"ruleId": "scanner-431d8b6ba442560b", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "80ad87194696460b", "scanner": "scanner-primary", "fingerprint": "431d8b6ba442560b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-07616f3c257ceee1", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.7.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "80ad87194696460b", "scanner": "scanner-primary", "fingerprint": "07616f3c257ceee1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-1011951def01e906", "level": "warning", "message": {"text": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4ed1eebd8d063efc", "scanner": "scanner-primary", "fingerprint": "1011951def01e906", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-26159"]}}, {"ruleId": "scanner-a08637610db0f4d9", "level": "warning", "message": {"text": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3e7246bff0a9ebad", "scanner": "scanner-primary", "fingerprint": "a08637610db0f4d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-28849"]}}, {"ruleId": "scanner-9cd10585d657e0ae", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "46386954dbcb0757", "scanner": "scanner-primary", "fingerprint": "9cd10585d657e0ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-130674c8daeef1a5", "level": "error", "message": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "b1675dc4453f5b17", "scanner": "scanner-primary", "fingerprint": "130674c8daeef1a5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7783"]}}, {"ruleId": "scanner-fa4f3605db04dee2", "level": "error", "message": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "c235a48b4b751cca", "scanner": "scanner-primary", "fingerprint": "fa4f3605db04dee2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-264b1877a86e58eb", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "37bc5307fd06d1cb", "scanner": "scanner-primary", "fingerprint": "264b1877a86e58eb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-ab31bffc25b6dd04", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2b57a06e46705fdd", "scanner": "scanner-primary", "fingerprint": "ab31bffc25b6dd04", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-af2589de4bf5f12a", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a5c0767336e439ce", "scanner": "scanner-primary", "fingerprint": "af2589de4bf5f12a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-5421cd2f526620ca", "level": "error", "message": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a7c1be3e94e9de8b", "scanner": "scanner-primary", "fingerprint": "5421cd2f526620ca", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-35024875a6547d68", "level": "warning", "message": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "7d2c347efc56aa31", "scanner": "scanner-primary", "fingerprint": "35024875a6547d68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-a3ec518c157b916a", "level": "warning", "message": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3fe7bbf01be9bb87", "scanner": "scanner-primary", "fingerprint": "a3ec518c157b916a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-223ba901c5bb467e", "level": "warning", "message": {"text": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "e6fa4301f8255dbc", "scanner": "scanner-primary", "fingerprint": "223ba901c5bb467e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66400"]}}, {"ruleId": "scanner-62de900c36a5c5ee", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "fcaf34894a11028c", "scanner": "scanner-primary", "fingerprint": "62de900c36a5c5ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-45dd2bc15a23a190", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "be8e6586e279b516", "scanner": "scanner-primary", "fingerprint": "45dd2bc15a23a190", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-02d9231874d9890d", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "75d32da556727507", "scanner": "scanner-primary", "fingerprint": "02d9231874d9890d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-88887d2146e94474", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "f3d496f883ba1b73", "scanner": "scanner-primary", "fingerprint": "88887d2146e94474", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-e109eaa8f28e80ad", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 3.3.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3e2a7ad4590b3263", "scanner": "scanner-primary", "fingerprint": "e109eaa8f28e80ad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-ac2818d0271e0523", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 3.3.11 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "0df152a48c81b7a0", "scanner": "scanner-primary", "fingerprint": "ac2818d0271e0523", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-9f327f3c7f54205e", "level": "error", "message": {"text": "CVE-2024-4367: pdfjs-dist 3.11.174 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4dab85461ade28d8", "scanner": "scanner-primary", "fingerprint": "9f327f3c7f54205e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-4367"]}}, {"ruleId": "scanner-a8398775014fa9bc", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "ed81b8fa0bddea60", "scanner": "scanner-primary", "fingerprint": "a8398775014fa9bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-cf7454e7d22f3283", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "7c8f0c6543e1474c", "scanner": "scanner-primary", "fingerprint": "cf7454e7d22f3283", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-bfd52f3b9c2c7438", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "68418318ba1a04a3", "scanner": "scanner-primary", "fingerprint": "bfd52f3b9c2c7438", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-d215e1850484ec67", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "fba40c59a5b09dc3", "scanner": "scanner-primary", "fingerprint": "d215e1850484ec67", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-7dc662b97633c05c", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "e5c42855b566e2c8", "scanner": "scanner-primary", "fingerprint": "7dc662b97633c05c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-7781a19e3989511b", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.5.6 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "489c0b28e862946a", "scanner": "scanner-primary", "fingerprint": "7781a19e3989511b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-fc2759b0f97dd1cd", "level": "warning", "message": {"text": "CVE-2024-53382: prismjs 1.27.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2657d9d0a23cb723", "scanner": "scanner-primary", "fingerprint": "fc2759b0f97dd1cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-53382"]}}, {"ruleId": "scanner-930829ac9b7d5a99", "level": "warning", "message": {"text": "CVE-2024-53382: prismjs 1.29.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2657d9d0a23cb723", "scanner": "scanner-primary", "fingerprint": "930829ac9b7d5a99", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-53382"]}}, {"ruleId": "scanner-0e334a132a24668e", "level": "error", "message": {"text": "CVE-2026-41242: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "940faab0b4cd61aa", "scanner": "scanner-primary", "fingerprint": "0e334a132a24668e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41242"]}}, {"ruleId": "scanner-ed29d790252979e1", "level": "error", "message": {"text": "CVE-2026-44289: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "6fda155eaee63b82", "scanner": "scanner-primary", "fingerprint": "ed29d790252979e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44289"]}}, {"ruleId": "scanner-6eeff36700d791d3", "level": "error", "message": {"text": "CVE-2026-44290: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "1078bb887db9a4d3", "scanner": "scanner-primary", "fingerprint": "6eeff36700d791d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44290"]}}, {"ruleId": "scanner-4525cdd81be478fe", "level": "error", "message": {"text": "CVE-2026-44291: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3d4c83aa23e13e3e", "scanner": "scanner-primary", "fingerprint": "4525cdd81be478fe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44291"]}}, {"ruleId": "scanner-bc3f622ed478b6ee", "level": "error", "message": {"text": "CVE-2026-44293: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "7666d62506b5ef31", "scanner": "scanner-primary", "fingerprint": "bc3f622ed478b6ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44293"]}}, {"ruleId": "scanner-fc15b00534c5c18b", "level": "error", "message": {"text": "CVE-2026-48712: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4e7e71283c8e3107", "scanner": "scanner-primary", "fingerprint": "fc15b00534c5c18b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48712"]}}, {"ruleId": "scanner-fdac44d350a7c7d7", "level": "warning", "message": {"text": "CVE-2026-44288: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "df95a0210800d505", "scanner": "scanner-primary", "fingerprint": "fdac44d350a7c7d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-c12aece4c78daaa4", "level": "warning", "message": {"text": "CVE-2026-44292: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "c3246432bfe2268d", "scanner": "scanner-primary", "fingerprint": "c12aece4c78daaa4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44292"]}}, {"ruleId": "scanner-0ab942ad66f81f89", "level": "warning", "message": {"text": "CVE-2026-44294: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "7f2d16c497474507", "scanner": "scanner-primary", "fingerprint": "0ab942ad66f81f89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44294"]}}, {"ruleId": "scanner-de3c2606dcb6df9a", "level": "warning", "message": {"text": "CVE-2026-45740: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "341676f90a5bfab3", "scanner": "scanner-primary", "fingerprint": "de3c2606dcb6df9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45740"]}}, {"ruleId": "scanner-abce65fd1d786957", "level": "warning", "message": {"text": "CVE-2026-54269: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "9eca86e95af14043", "scanner": "scanner-primary", "fingerprint": "abce65fd1d786957", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54269"]}}, {"ruleId": "scanner-5eb2b387fde1a279", "level": "warning", "message": {"text": "CVE-2026-59877: protobufjs 7.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "572f0c8cb6c49283", "scanner": "scanner-primary", "fingerprint": "5eb2b387fde1a279", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59877"]}}, {"ruleId": "scanner-d3f01f26cb4d22be", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.13.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "dffff25de0bc3857", "scanner": "scanner-primary", "fingerprint": "d3f01f26cb4d22be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-375d4bf0b20e5d43", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.13.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "abe077be18aa50bc", "scanner": "scanner-primary", "fingerprint": "375d4bf0b20e5d43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-7340bbe99bcdb325", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.13.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3a3ca617df78d13f", "scanner": "scanner-primary", "fingerprint": "7340bbe99bcdb325", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-8243decf874bb362", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.13.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "cf169b3c9c93f2d7", "scanner": "scanner-primary", "fingerprint": "8243decf874bb362", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-65e1115aab90c3df", "level": "warning", "message": {"text": "CVE-2021-3163: quill 1.3.7 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "c4115989831ffe1e", "scanner": "scanner-primary", "fingerprint": "65e1115aab90c3df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-3163"]}}, {"ruleId": "scanner-4cc6e813c00ab882", "level": "note", "message": {"text": "CVE-2025-15056: quill 2.0.3 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "769c1fa6b1e8f9bc", "scanner": "scanner-primary", "fingerprint": "4cc6e813c00ab882", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15056"]}}, {"ruleId": "scanner-67e9f53067a74c86", "level": "warning", "message": {"text": "CVE-2025-68470: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "d73029ad2bae38b3", "scanner": "scanner-primary", "fingerprint": "67e9f53067a74c86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68470"]}}, {"ruleId": "scanner-5d1e36a1cbc61fdd", "level": "warning", "message": {"text": "CVE-2026-40181: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "7853dfd00c5b0eef", "scanner": "scanner-primary", "fingerprint": "5d1e36a1cbc61fdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40181"]}}, {"ruleId": "scanner-ccc78d24ad962ac8", "level": "warning", "message": {"text": "CVE-2026-53666: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "712d25f0eb347e42", "scanner": "scanner-primary", "fingerprint": "ccc78d24ad962ac8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53666"]}}, {"ruleId": "scanner-ef4ca5834748fa88", "level": "warning", "message": {"text": "CVE-2026-53669: react-router 6.16.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "deac5f7e2dbe955d", "scanner": "scanner-primary", "fingerprint": "ef4ca5834748fa88", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53669"]}}, {"ruleId": "scanner-081489eb5bcdb562", "level": "error", "message": {"text": "CVE-2026-59873: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "e00c51c1faceb06f", "scanner": "scanner-primary", "fingerprint": "081489eb5bcdb562", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59873"]}}, {"ruleId": "scanner-87fee689958904cf", "level": "error", "message": {"text": "CVE-2026-23745: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a89a76e3f0866525", "scanner": "scanner-primary", "fingerprint": "87fee689958904cf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23745"]}}, {"ruleId": "scanner-f33e979ca421a01e", "level": "error", "message": {"text": "CVE-2026-23950: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4cc6c3fc405b83e7", "scanner": "scanner-primary", "fingerprint": "f33e979ca421a01e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23950"]}}, {"ruleId": "scanner-43d2959233e37f24", "level": "error", "message": {"text": "CVE-2026-24842: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "54faa01f3ccd2e07", "scanner": "scanner-primary", "fingerprint": "43d2959233e37f24", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24842"]}}, {"ruleId": "scanner-50e8027f69c8f06c", "level": "error", "message": {"text": "CVE-2026-26960: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "37846900658d7b51", "scanner": "scanner-primary", "fingerprint": "50e8027f69c8f06c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26960"]}}, {"ruleId": "scanner-c87b60b2faf3865c", "level": "error", "message": {"text": "CVE-2026-29786: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "06067db19f0d2a67", "scanner": "scanner-primary", "fingerprint": "c87b60b2faf3865c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29786"]}}, {"ruleId": "scanner-4e5f5bede9ef3f59", "level": "error", "message": {"text": "CVE-2026-31802: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "ba0b2b754abbd3e7", "scanner": "scanner-primary", "fingerprint": "4e5f5bede9ef3f59", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31802"]}}, {"ruleId": "scanner-14a489eae9eb3c3d", "level": "error", "message": {"text": "CVE-2026-59874: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a42e7730ee944f3b", "scanner": "scanner-primary", "fingerprint": "14a489eae9eb3c3d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59874"]}}, {"ruleId": "scanner-aecd4f0db4e462bc", "level": "error", "message": {"text": "CVE-2026-73566: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a529f1c7f38bc56f", "scanner": "scanner-primary", "fingerprint": "aecd4f0db4e462bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73566"]}}, {"ruleId": "scanner-4b9afe995736a82b", "level": "warning", "message": {"text": "CVE-2026-53655: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "903141cdcfd34421", "scanner": "scanner-primary", "fingerprint": "4b9afe995736a82b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53655"]}}, {"ruleId": "scanner-a3c5eebc711b66b8", "level": "warning", "message": {"text": "CVE-2026-59871: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "38f05a59d4552e60", "scanner": "scanner-primary", "fingerprint": "a3c5eebc711b66b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59871"]}}, {"ruleId": "scanner-b2d9036efe0223d4", "level": "warning", "message": {"text": "CVE-2026-59875: tar 6.2.1 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "39e03dc6626fc0fd", "scanner": "scanner-primary", "fingerprint": "b2d9036efe0223d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59875"]}}, {"ruleId": "scanner-f25ec3aa3467d069", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 13.0.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "6c103e1280745fbc", "scanner": "scanner-primary", "fingerprint": "f25ec3aa3467d069", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-40af59b267e5ea94", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "25607eeacb09775b", "scanner": "scanner-primary", "fingerprint": "40af59b267e5ea94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-4bbfb1ac530764bb", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 2.8.2 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "25607eeacb09775b", "scanner": "scanner-primary", "fingerprint": "4bbfb1ac530764bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-973bcc3e14770edc", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.27.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "7213544369fc0608", "scanner": "scanner-primary", "fingerprint": "973bcc3e14770edc", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-ef92c1be66f4aec3", "level": "warning", "message": {"text": "CVE-2025-27789: @babel/runtime 7.24.6 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "466d01482d396f55", "scanner": "scanner-primary", "fingerprint": "ef92c1be66f4aec3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27789"]}}, {"ruleId": "scanner-31def5155118a1f4", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 2.2.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "98ea8955be0b23e9", "scanner": "scanner-primary", "fingerprint": "31def5155118a1f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-c3cc28854c64cb62", "level": "warning", "message": {"text": "CVE-2026-54285: @opentelemetry/core 2.6.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "98ea8955be0b23e9", "scanner": "scanner-primary", "fingerprint": "c3cc28854c64cb62", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54285"]}}, {"ruleId": "scanner-79185c0e01b569bf", "level": "warning", "message": {"text": "CVE-2026-44288: @protobufjs/utf8 1.1.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c9462f584985d9b2", "scanner": "scanner-primary", "fingerprint": "79185c0e01b569bf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-1f4a8120c859c604", "level": "error", "message": {"text": "CVE-2026-22029: @remix-run/router 1.9.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "baf0f7d928a1c686", "scanner": "scanner-primary", "fingerprint": "1f4a8120c859c604", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22029"]}}, {"ruleId": "scanner-9df99dc80f457fdc", "level": "warning", "message": {"text": "CVE-2026-40181: @remix-run/router 1.9.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c13efb0504db2bb1", "scanner": "scanner-primary", "fingerprint": "9df99dc80f457fdc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40181"]}}, {"ruleId": "scanner-5d65fafcc0f5da54", "level": "error", "message": {"text": "CVE-2024-39338: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "b0b012a37b0b7349", "scanner": "scanner-primary", "fingerprint": "5d65fafcc0f5da54", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-39338"]}}, {"ruleId": "scanner-ad31cb444f48ece7", "level": "error", "message": {"text": "CVE-2025-27152: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "7de70ab2c1233915", "scanner": "scanner-primary", "fingerprint": "ad31cb444f48ece7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27152"]}}, {"ruleId": "scanner-7be4162dc16e93f2", "level": "error", "message": {"text": "CVE-2025-58754: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "f722f63564f5d7a1", "scanner": "scanner-primary", "fingerprint": "7be4162dc16e93f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-58754"]}}, {"ruleId": "scanner-0126bc253f7eea36", "level": "error", "message": {"text": "CVE-2026-25639: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "25aa70f4eaf47594", "scanner": "scanner-primary", "fingerprint": "0126bc253f7eea36", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-6d797fc4fe4e7995", "level": "error", "message": {"text": "CVE-2026-42033: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c558400613b50f4a", "scanner": "scanner-primary", "fingerprint": "6d797fc4fe4e7995", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-3a76b0d40d7e415b", "level": "error", "message": {"text": "CVE-2026-42035: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c0298ce0129aeefa", "scanner": "scanner-primary", "fingerprint": "3a76b0d40d7e415b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-d8f8b50050e0e11d", "level": "error", "message": {"text": "CVE-2026-42043: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "ca607a65f6e034f3", "scanner": "scanner-primary", "fingerprint": "d8f8b50050e0e11d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-32e6563df6347343", "level": "error", "message": {"text": "CVE-2026-42264: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c9379a406e6daec0", "scanner": "scanner-primary", "fingerprint": "32e6563df6347343", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42264"]}}, {"ruleId": "scanner-c25e8b6b9729b3b0", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "73b7dd466aa9296b", "scanner": "scanner-primary", "fingerprint": "c25e8b6b9729b3b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-928aea9377b6e9d3", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "79408051b7c30a9b", "scanner": "scanner-primary", "fingerprint": "928aea9377b6e9d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-51804ca5fab4fc9b", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "37df4e6f40cc148f", "scanner": "scanner-primary", "fingerprint": "51804ca5fab4fc9b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-9e9acf6b700bc31e", "level": "error", "message": {"text": "CVE-2026-44495: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "66a53c43f7bbc906", "scanner": "scanner-primary", "fingerprint": "9e9acf6b700bc31e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-6ca2f809b4d03cab", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c5caf8b144b8b76e", "scanner": "scanner-primary", "fingerprint": "6ca2f809b4d03cab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-413b8eb7667e6fe0", "level": "warning", "message": {"text": "CVE-2023-45857: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "37441cfa7a930e2d", "scanner": "scanner-primary", "fingerprint": "413b8eb7667e6fe0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-45857"]}}, {"ruleId": "scanner-60cd5ad444b178f2", "level": "warning", "message": {"text": "CVE-2025-62718: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "4493bd4b80bd90c8", "scanner": "scanner-primary", "fingerprint": "60cd5ad444b178f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-b8ce6004946703a0", "level": "warning", "message": {"text": "CVE-2026-40175: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "a8286f9f1b3ba85a", "scanner": "scanner-primary", "fingerprint": "b8ce6004946703a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-4d30c67f988d3006", "level": "warning", "message": {"text": "CVE-2026-42034: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "23073640491e7bb7", "scanner": "scanner-primary", "fingerprint": "4d30c67f988d3006", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-faeffbbfedbf0afe", "level": "warning", "message": {"text": "CVE-2026-42036: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "f77e12313c83445c", "scanner": "scanner-primary", "fingerprint": "faeffbbfedbf0afe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-cf28d5c662d00c91", "level": "warning", "message": {"text": "CVE-2026-42037: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "106f2de14dffaa10", "scanner": "scanner-primary", "fingerprint": "cf28d5c662d00c91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42037"]}}, {"ruleId": "scanner-202f6039481a091d", "level": "warning", "message": {"text": "CVE-2026-42038: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "53f919a98cfdcb0e", "scanner": "scanner-primary", "fingerprint": "202f6039481a091d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-8370b7e43568e085", "level": "warning", "message": {"text": "CVE-2026-42039: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "29610a6884e42519", "scanner": "scanner-primary", "fingerprint": "8370b7e43568e085", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-e89b3f361d2b17cd", "level": "warning", "message": {"text": "CVE-2026-42041: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "bb7cacfd2ce72bf5", "scanner": "scanner-primary", "fingerprint": "e89b3f361d2b17cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-8bfb6a7ff8882310", "level": "warning", "message": {"text": "CVE-2026-42042: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "127629eb05e3c991", "scanner": "scanner-primary", "fingerprint": "8bfb6a7ff8882310", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-0175b80c3e74c2c9", "level": "warning", "message": {"text": "CVE-2026-42044: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "be3710b7f9208bae", "scanner": "scanner-primary", "fingerprint": "0175b80c3e74c2c9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42044"]}}, {"ruleId": "scanner-2c29153115581a85", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "381104076ca8fdf0", "scanner": "scanner-primary", "fingerprint": "2c29153115581a85", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-73e0901fb7ea62da", "level": "warning", "message": {"text": "CVE-2026-67312: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "302edd046642ad3e", "scanner": "scanner-primary", "fingerprint": "73e0901fb7ea62da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67312"]}}, {"ruleId": "scanner-ca15646390ca05aa", "level": "warning", "message": {"text": "CVE-2026-67313: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "73ddf748aea179c4", "scanner": "scanner-primary", "fingerprint": "ca15646390ca05aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67313"]}}, {"ruleId": "scanner-079ddb1925bc3271", "level": "warning", "message": {"text": "CVE-2026-67316: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "42bbab840232b968", "scanner": "scanner-primary", "fingerprint": "079ddb1925bc3271", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67316"]}}, {"ruleId": "scanner-787b2a1d4ee576ad", "level": "warning", "message": {"text": "CVE-2026-67319: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "201825dbee1b8b99", "scanner": "scanner-primary", "fingerprint": "787b2a1d4ee576ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67319"]}}, {"ruleId": "scanner-4647a65a42aaaed0", "level": "note", "message": {"text": "CVE-2026-42040: axios 1.5.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "005a32fdaf15b06e", "scanner": "scanner-primary", "fingerprint": "4647a65a42aaaed0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-d50144574cbea515", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "1d5feb161d5083b2", "scanner": "scanner-primary", "fingerprint": "d50144574cbea515", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-2468c4505dd77f1e", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "bc5e45e82a3c0ef1", "scanner": "scanner-primary", "fingerprint": "2468c4505dd77f1e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-4253727112bb722a", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "5c1dab4a90dde703", "scanner": "scanner-primary", "fingerprint": "4253727112bb722a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-394d5f10f2d1d977", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d7f351c01e64efb6", "scanner": "scanner-primary", "fingerprint": "394d5f10f2d1d977", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-0c0282388d10abaf", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "e35d0e3f387b4513", "scanner": "scanner-primary", "fingerprint": "0c0282388d10abaf", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-160b5799dc02b0d9", "level": "error", "message": {"text": "CVE-2026-73088: browserslist 4.24.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "96980408e3456773", "scanner": "scanner-primary", "fingerprint": "160b5799dc02b0d9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73088"]}}, {"ruleId": "scanner-b5c2cc05a2d0caff", "level": "error", "message": {"text": "CVE-2026-73089: browserslist 4.24.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "4190dc50283b0519", "scanner": "scanner-primary", "fingerprint": "b5c2cc05a2d0caff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73089"]}}, {"ruleId": "scanner-c609d73aab45e90b", "level": "note", "message": {"text": "CVE-2026-24001: diff 8.0.2 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "943ef780dcb8b359", "scanner": "scanner-primary", "fingerprint": "c609d73aab45e90b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24001"]}}, {"ruleId": "scanner-083a83a7c5731f96", "level": "warning", "message": {"text": "CVE-2026-41238: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "f84dffd5e015f2ff", "scanner": "scanner-primary", "fingerprint": "083a83a7c5731f96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41238"]}}, {"ruleId": "scanner-e7b40269dfe7a040", "level": "warning", "message": {"text": "CVE-2026-41239: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d80f105ab4416be2", "scanner": "scanner-primary", "fingerprint": "e7b40269dfe7a040", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41239"]}}, {"ruleId": "scanner-5c865cd809357030", "level": "warning", "message": {"text": "CVE-2026-41240: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "3d41d76966365e5c", "scanner": "scanner-primary", "fingerprint": "5c865cd809357030", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41240"]}}, {"ruleId": "scanner-b9c8e0ff8d7c0d51", "level": "warning", "message": {"text": "CVE-2026-49458: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "904fe2da9965abfa", "scanner": "scanner-primary", "fingerprint": "b9c8e0ff8d7c0d51", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49458"]}}, {"ruleId": "scanner-45226fab682c79bb", "level": "warning", "message": {"text": "CVE-2026-49459: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "e8d3062a65488d5f", "scanner": "scanner-primary", "fingerprint": "45226fab682c79bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49459"]}}, {"ruleId": "scanner-44d6b7f150d52df3", "level": "warning", "message": {"text": "CVE-2026-49978: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "196b77d81f12aa66", "scanner": "scanner-primary", "fingerprint": "44d6b7f150d52df3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49978"]}}, {"ruleId": "scanner-15d67f2b9b9c0eb7", "level": "warning", "message": {"text": "CVE-2026-65898: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "5ece05436fe4e8a2", "scanner": "scanner-primary", "fingerprint": "15d67f2b9b9c0eb7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65898"]}}, {"ruleId": "scanner-5f5b7253a598db58", "level": "warning", "message": {"text": "CVE-2026-65902: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "37dbfb7ec1455063", "scanner": "scanner-primary", "fingerprint": "5f5b7253a598db58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65902"]}}, {"ruleId": "scanner-d1d851ee9dc8476d", "level": "warning", "message": {"text": "CVE-2026-65903: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "caf3c46bbd30b3be", "scanner": "scanner-primary", "fingerprint": "d1d851ee9dc8476d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65903"]}}, {"ruleId": "scanner-7f45c100057eb3e2", "level": "warning", "message": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "9d8eeb4a3c146d53", "scanner": "scanner-primary", "fingerprint": "7f45c100057eb3e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-55q2-fjhq-7xh7"]}}, {"ruleId": "scanner-9fb7bdc08269e160", "level": "note", "message": {"text": "CVE-2026-65899: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "754a83b009b0cfdd", "scanner": "scanner-primary", "fingerprint": "9fb7bdc08269e160", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65899"]}}, {"ruleId": "scanner-ecf86cf0bae09cee", "level": "note", "message": {"text": "CVE-2026-65900: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "ee734c9603f8ec35", "scanner": "scanner-primary", "fingerprint": "ecf86cf0bae09cee", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65900"]}}, {"ruleId": "scanner-5eab2472ba887522", "level": "note", "message": {"text": "CVE-2026-65901: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "aa09e7021167d8e3", "scanner": "scanner-primary", "fingerprint": "5eab2472ba887522", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65901"]}}, {"ruleId": "scanner-519c858f90d427e3", "level": "note", "message": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.3.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c5db4d22b4693c38", "scanner": "scanner-primary", "fingerprint": "519c858f90d427e3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-c2j3-45gr-mqc4"]}}, {"ruleId": "scanner-d803685053983b81", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "0880ff4c0c30ab29", "scanner": "scanner-primary", "fingerprint": "d803685053983b81", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-943aa578bd52c12c", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.7.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "0880ff4c0c30ab29", "scanner": "scanner-primary", "fingerprint": "943aa578bd52c12c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-00a6037652b33ee8", "level": "warning", "message": {"text": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "03fc77b7f83bf940", "scanner": "scanner-primary", "fingerprint": "00a6037652b33ee8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-26159"]}}, {"ruleId": "scanner-c45114ffe2a4876e", "level": "warning", "message": {"text": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "8adf39537036c3cd", "scanner": "scanner-primary", "fingerprint": "c45114ffe2a4876e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-28849"]}}, {"ruleId": "scanner-769903f0611ac167", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "113fe6cc277469a4", "scanner": "scanner-primary", "fingerprint": "769903f0611ac167", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-1729202193ea1bd9", "level": "error", "message": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "bbeb7ee77a317bfc", "scanner": "scanner-primary", "fingerprint": "1729202193ea1bd9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7783"]}}, {"ruleId": "scanner-e59024b120826607", "level": "error", "message": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "e8e8fb12fc5dd09e", "scanner": "scanner-primary", "fingerprint": "e59024b120826607", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-73db3e8d108ca7a5", "level": "error", "message": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "ffb124deac78751c", "scanner": "scanner-primary", "fingerprint": "73db3e8d108ca7a5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-6a00781939047319", "level": "warning", "message": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "9604fc6f7d5975fe", "scanner": "scanner-primary", "fingerprint": "6a00781939047319", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-76a5dd7f48e2c56b", "level": "warning", "message": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "290df8015c148fd0", "scanner": "scanner-primary", "fingerprint": "76a5dd7f48e2c56b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-f3d9eb69d1cba5ff", "level": "warning", "message": {"text": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "dfcd5432a86b91d7", "scanner": "scanner-primary", "fingerprint": "f3d9eb69d1cba5ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66400"]}}, {"ruleId": "scanner-07ffd50ccbb1423f", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 8.0.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "fb6a289ff89991b7", "scanner": "scanner-primary", "fingerprint": "07ffd50ccbb1423f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-cf62e8db59b6eefa", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 8.0.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "ce1c3e3e743a1591", "scanner": "scanner-primary", "fingerprint": "cf62e8db59b6eefa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-8464b6c7ccf6fd48", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 8.0.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d9e9db2a30c1b8c3", "scanner": "scanner-primary", "fingerprint": "8464b6c7ccf6fd48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-87c3b1e3583c19c1", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "42720153ba96a6f8", "scanner": "scanner-primary", "fingerprint": "87c3b1e3583c19c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-674582d5071f7472", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "57089c524ad702fd", "scanner": "scanner-primary", "fingerprint": "674582d5071f7472", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-c646170b588c229c", "level": "error", "message": {"text": "CVE-2026-73086: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "685703dba243cf6e", "scanner": "scanner-primary", "fingerprint": "c646170b588c229c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73086"]}}, {"ruleId": "scanner-ccfc179b324abda6", "level": "warning", "message": {"text": "CVE-2024-55565: nanoid 3.3.7 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "3398af08a68af22d", "scanner": "scanner-primary", "fingerprint": "ccfc179b324abda6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-55565"]}}, {"ruleId": "scanner-8e1fc610f4f56fcc", "level": "error", "message": {"text": "CVE-2024-4367: pdfjs-dist 3.11.174 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "16167b1a4dbee201", "scanner": "scanner-primary", "fingerprint": "8e1fc610f4f56fcc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-4367"]}}, {"ruleId": "scanner-bf2df062655cf396", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "b052f686cc081046", "scanner": "scanner-primary", "fingerprint": "bf2df062655cf396", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-5207ffe534611bc1", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d631ce664fdf1edf", "scanner": "scanner-primary", "fingerprint": "5207ffe534611bc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-d9e6a259ba9d7ba2", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "6a4886c5c1d642cc", "scanner": "scanner-primary", "fingerprint": "d9e6a259ba9d7ba2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-78aa616104a967d7", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "4913a114d2e8690a", "scanner": "scanner-primary", "fingerprint": "78aa616104a967d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-8a1a3f4763c4e27a", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "6d15bc30ba659a43", "scanner": "scanner-primary", "fingerprint": "8a1a3f4763c4e27a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-9c4d3c05b6a0c4ae", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.4.41 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "c8fdc47dd5066e74", "scanner": "scanner-primary", "fingerprint": "9c4d3c05b6a0c4ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-de88864dabaa1ee1", "level": "warning", "message": {"text": "CVE-2024-53382: prismjs 1.27.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "0c5c223370a6d928", "scanner": "scanner-primary", "fingerprint": "de88864dabaa1ee1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-53382"]}}, {"ruleId": "scanner-208332334a9e61dc", "level": "warning", "message": {"text": "CVE-2024-53382: prismjs 1.29.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "0c5c223370a6d928", "scanner": "scanner-primary", "fingerprint": "208332334a9e61dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-53382"]}}, {"ruleId": "scanner-427c4f927140a4fb", "level": "error", "message": {"text": "CVE-2026-41242: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "40fb4d35bb590b45", "scanner": "scanner-primary", "fingerprint": "427c4f927140a4fb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41242"]}}, {"ruleId": "scanner-723f8f050e447339", "level": "error", "message": {"text": "CVE-2026-44289: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d01d0fd7ab29e7ba", "scanner": "scanner-primary", "fingerprint": "723f8f050e447339", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44289"]}}, {"ruleId": "scanner-e32922d6ad964680", "level": "error", "message": {"text": "CVE-2026-44290: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "7164fc9fcb7c8054", "scanner": "scanner-primary", "fingerprint": "e32922d6ad964680", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44290"]}}, {"ruleId": "scanner-46f6494e5fe8da46", "level": "error", "message": {"text": "CVE-2026-44291: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "76573553f2c32cc0", "scanner": "scanner-primary", "fingerprint": "46f6494e5fe8da46", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44291"]}}, {"ruleId": "scanner-c8535860130155cd", "level": "error", "message": {"text": "CVE-2026-44293: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "919745d3691f6777", "scanner": "scanner-primary", "fingerprint": "c8535860130155cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44293"]}}, {"ruleId": "scanner-84b6b9d39be029d9", "level": "error", "message": {"text": "CVE-2026-48712: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "2cf02771ae6be265", "scanner": "scanner-primary", "fingerprint": "84b6b9d39be029d9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48712"]}}, {"ruleId": "scanner-9acf4934bbb3c142", "level": "warning", "message": {"text": "CVE-2026-44288: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "2e697566e965d436", "scanner": "scanner-primary", "fingerprint": "9acf4934bbb3c142", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44288"]}}, {"ruleId": "scanner-4365c2bbba0a22a4", "level": "warning", "message": {"text": "CVE-2026-44292: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "8df69f4d7f544fcb", "scanner": "scanner-primary", "fingerprint": "4365c2bbba0a22a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44292"]}}, {"ruleId": "scanner-93a71551f7eb2cc4", "level": "warning", "message": {"text": "CVE-2026-44294: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "fa709a9ba6705b68", "scanner": "scanner-primary", "fingerprint": "93a71551f7eb2cc4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44294"]}}, {"ruleId": "scanner-36fa288365997acd", "level": "warning", "message": {"text": "CVE-2026-45740: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "52740a631652d2b3", "scanner": "scanner-primary", "fingerprint": "36fa288365997acd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45740"]}}, {"ruleId": "scanner-6884d9c8e2bd4eba", "level": "warning", "message": {"text": "CVE-2026-54269: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "afe0d4753aee4d07", "scanner": "scanner-primary", "fingerprint": "6884d9c8e2bd4eba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54269"]}}, {"ruleId": "scanner-368a094cfd8a8c50", "level": "warning", "message": {"text": "CVE-2026-59877: protobufjs 7.5.4 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "7d3185f8a632b0cc", "scanner": "scanner-primary", "fingerprint": "368a094cfd8a8c50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59877"]}}, {"ruleId": "scanner-aee85d81212a2e45", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.13.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "b528e6d47e9cb51c", "scanner": "scanner-primary", "fingerprint": "aee85d81212a2e45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-089e12278400bc91", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.13.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "3c81ac2cd3f811dd", "scanner": "scanner-primary", "fingerprint": "089e12278400bc91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-d83804fd8a382b4a", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.13.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "69caf28cf610f1d0", "scanner": "scanner-primary", "fingerprint": "d83804fd8a382b4a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-f6a146b08c4cfaed", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.13.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "b5b1baca4131b7a5", "scanner": "scanner-primary", "fingerprint": "f6a146b08c4cfaed", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-e51ccb948e94902c", "level": "warning", "message": {"text": "CVE-2021-3163: quill 1.3.7 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "54975bfd2414699e", "scanner": "scanner-primary", "fingerprint": "e51ccb948e94902c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-3163"]}}, {"ruleId": "scanner-8a75588aedf1bf3e", "level": "note", "message": {"text": "CVE-2025-15056: quill 2.0.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "b82b20cc6f0001d5", "scanner": "scanner-primary", "fingerprint": "8a75588aedf1bf3e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15056"]}}, {"ruleId": "scanner-1b104541ed7e07e7", "level": "warning", "message": {"text": "CVE-2025-68470: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "67a3772bf3abfaf6", "scanner": "scanner-primary", "fingerprint": "1b104541ed7e07e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68470"]}}, {"ruleId": "scanner-30d3b2e7ab0a6893", "level": "warning", "message": {"text": "CVE-2026-40181: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d607940a0522cd8b", "scanner": "scanner-primary", "fingerprint": "30d3b2e7ab0a6893", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40181"]}}, {"ruleId": "scanner-38751dc4f953e5d7", "level": "warning", "message": {"text": "CVE-2026-53666: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "0e390595b4673d93", "scanner": "scanner-primary", "fingerprint": "38751dc4f953e5d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53666"]}}, {"ruleId": "scanner-d19284278f259465", "level": "warning", "message": {"text": "CVE-2026-53669: react-router 6.16.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "4f0fe975f3e09bcb", "scanner": "scanner-primary", "fingerprint": "d19284278f259465", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53669"]}}, {"ruleId": "scanner-22f891bcd84f8907", "level": "error", "message": {"text": "CVE-2026-27212: swiper 12.0.3 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "2116aadfed0705f9", "scanner": "scanner-primary", "fingerprint": "22f891bcd84f8907", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27212"]}}, {"ruleId": "scanner-3c64095a6bd9fba1", "level": "error", "message": {"text": "CVE-2026-59873: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "17e4c67e38e94428", "scanner": "scanner-primary", "fingerprint": "3c64095a6bd9fba1", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59873"]}}, {"ruleId": "scanner-d1fa8595bd287c92", "level": "error", "message": {"text": "CVE-2026-23745: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "dc04fe721fb84a40", "scanner": "scanner-primary", "fingerprint": "d1fa8595bd287c92", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23745"]}}, {"ruleId": "scanner-b73777ae6925ee8c", "level": "error", "message": {"text": "CVE-2026-23950: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "fe123c94d782b960", "scanner": "scanner-primary", "fingerprint": "b73777ae6925ee8c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23950"]}}, {"ruleId": "scanner-61fbe17ffc29b063", "level": "error", "message": {"text": "CVE-2026-24842: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "bcb772542a79103c", "scanner": "scanner-primary", "fingerprint": "61fbe17ffc29b063", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24842"]}}, {"ruleId": "scanner-89dc67af84da8cd5", "level": "error", "message": {"text": "CVE-2026-26960: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "dc314677376bde0c", "scanner": "scanner-primary", "fingerprint": "89dc67af84da8cd5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26960"]}}, {"ruleId": "scanner-46778567f2d2aa72", "level": "error", "message": {"text": "CVE-2026-29786: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "20916975b96fbaf9", "scanner": "scanner-primary", "fingerprint": "46778567f2d2aa72", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29786"]}}, {"ruleId": "scanner-59056e019da0ed80", "level": "error", "message": {"text": "CVE-2026-31802: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "1926791f91ad942e", "scanner": "scanner-primary", "fingerprint": "59056e019da0ed80", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31802"]}}, {"ruleId": "scanner-48066af2107d0813", "level": "error", "message": {"text": "CVE-2026-59874: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "915b5d691c51f11f", "scanner": "scanner-primary", "fingerprint": "48066af2107d0813", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59874"]}}, {"ruleId": "scanner-4b1ee595640f627f", "level": "error", "message": {"text": "CVE-2026-73566: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "dde6ec39092a8b4e", "scanner": "scanner-primary", "fingerprint": "4b1ee595640f627f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73566"]}}, {"ruleId": "scanner-261b7eebd3db4fc3", "level": "warning", "message": {"text": "CVE-2026-53655: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "f6d98268fe3b951d", "scanner": "scanner-primary", "fingerprint": "261b7eebd3db4fc3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53655"]}}, {"ruleId": "scanner-c6a559d6b9750208", "level": "warning", "message": {"text": "CVE-2026-59871: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "1d4434dff6ee4aef", "scanner": "scanner-primary", "fingerprint": "c6a559d6b9750208", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59871"]}}, {"ruleId": "scanner-9fdc570209c8b5d8", "level": "warning", "message": {"text": "CVE-2026-59875: tar 6.2.1 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "3796d6eb78e747c2", "scanner": "scanner-primary", "fingerprint": "9fdc570209c8b5d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59875"]}}, {"ruleId": "scanner-f2408b2288e512b4", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 13.0.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "d723088daa0774b6", "scanner": "scanner-primary", "fingerprint": "f2408b2288e512b4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-d9e796e22d0a6b3d", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "9c64fe54e5eacaab", "scanner": "scanner-primary", "fingerprint": "d9e796e22d0a6b3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-42a4dcb468c1e484", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 2.8.0 \u2014 frontend/yarn.lock"}, "properties": {"repobilityId": "9c64fe54e5eacaab", "scanner": "scanner-primary", "fingerprint": "42a4dcb468c1e484", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-c6949d1a5af0f94c", "level": "warning", "message": {"text": "CVE-2026-39406: @hono/node-server 1.19.11 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "a46fe8c30678bec2", "scanner": "scanner-primary", "fingerprint": "c6949d1a5af0f94c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39406"]}}, {"ruleId": "scanner-d61180658e40b586", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "a0b02cdbc57d73bf", "scanner": "scanner-primary", "fingerprint": "d61180658e40b586", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-cf88baed4c0ab032", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 1.20.4 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "d90ad51b2a2d92c7", "scanner": "scanner-primary", "fingerprint": "cf88baed4c0ab032", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-e76f11af6645dc0c", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "d90ad51b2a2d92c7", "scanner": "scanner-primary", "fingerprint": "e76f11af6645dc0c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-1c7d00ecd4533725", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "b0153c229dde278e", "scanner": "scanner-primary", "fingerprint": "1c7d00ecd4533725", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-cf9d3c8a2fd7fc45", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "3f4465449cf7c3ee", "scanner": "scanner-primary", "fingerprint": "cf9d3c8a2fd7fc45", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-dbe3625b42c71a41", "level": "error", "message": {"text": "CVE-2026-18446: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "30083ca4852f45db", "scanner": "scanner-primary", "fingerprint": "dbe3625b42c71a41", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-18446"]}}, {"ruleId": "scanner-3a1efacb48bf8253", "level": "error", "message": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "c4a0f9281e6058c5", "scanner": "scanner-primary", "fingerprint": "3a1efacb48bf8253", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6321"]}}, {"ruleId": "scanner-ac6abbd8e2d980b6", "level": "error", "message": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "3ba13e8c5aa643c5", "scanner": "scanner-primary", "fingerprint": "ac6abbd8e2d980b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6322"]}}, {"ruleId": "scanner-d0ee4f31b5ec45ce", "level": "error", "message": {"text": "CVE-2026-75975: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "3e134fb6c3ea3ba4", "scanner": "scanner-primary", "fingerprint": "d0ee4f31b5ec45ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-75975"]}}, {"ruleId": "scanner-5a0191ca423a4391", "level": "error", "message": {"text": "CVE-2026-76172: fast-uri 3.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "ed8e02074430bef0", "scanner": "scanner-primary", "fingerprint": "5a0191ca423a4391", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-76172"]}}, {"ruleId": "scanner-9b7350928fa1844c", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "c26bdbeb8faa8cc6", "scanner": "scanner-primary", "fingerprint": "9b7350928fa1844c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-d8d861567596ce21", "level": "warning", "message": {"text": "CVE-2026-39407: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "9a38d0d08b54d7e5", "scanner": "scanner-primary", "fingerprint": "d8d861567596ce21", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39407"]}}, {"ruleId": "scanner-b6ec07230630e882", "level": "warning", "message": {"text": "CVE-2026-39408: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "1ac00a3ed5b0184b", "scanner": "scanner-primary", "fingerprint": "b6ec07230630e882", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39408"]}}, {"ruleId": "scanner-85753705b3de080e", "level": "warning", "message": {"text": "CVE-2026-39409: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "e7100571db84ee37", "scanner": "scanner-primary", "fingerprint": "85753705b3de080e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39409"]}}, {"ruleId": "scanner-d892a875dba360b5", "level": "warning", "message": {"text": "CVE-2026-39410: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "6be2515ffd879fee", "scanner": "scanner-primary", "fingerprint": "d892a875dba360b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39410"]}}, {"ruleId": "scanner-048e725ef5d1439a", "level": "warning", "message": {"text": "CVE-2026-44455: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "ba98cdf8f096ff5f", "scanner": "scanner-primary", "fingerprint": "048e725ef5d1439a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44455"]}}, {"ruleId": "scanner-6a0b7816d40877fa", "level": "warning", "message": {"text": "CVE-2026-44456: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "ca6338ae2bc08e2a", "scanner": "scanner-primary", "fingerprint": "6a0b7816d40877fa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44456"]}}, {"ruleId": "scanner-6f85ab6d1e538f2d", "level": "warning", "message": {"text": "CVE-2026-44457: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "de34cd2c2bcfccec", "scanner": "scanner-primary", "fingerprint": "6f85ab6d1e538f2d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44457"]}}, {"ruleId": "scanner-6b1464f4f113b129", "level": "warning", "message": {"text": "CVE-2026-44458: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "940275f5a21fdd68", "scanner": "scanner-primary", "fingerprint": "6b1464f4f113b129", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44458"]}}, {"ruleId": "scanner-2182437768914a70", "level": "warning", "message": {"text": "CVE-2026-47673: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "ef11fa5fab7cbe8e", "scanner": "scanner-primary", "fingerprint": "2182437768914a70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47673"]}}, {"ruleId": "scanner-f0af79f9214c0fac", "level": "warning", "message": {"text": "CVE-2026-47674: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "0c56626dde515111", "scanner": "scanner-primary", "fingerprint": "f0af79f9214c0fac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47674"]}}, {"ruleId": "scanner-7520a6525c910cfc", "level": "warning", "message": {"text": "CVE-2026-47675: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "9af82538ac75c89f", "scanner": "scanner-primary", "fingerprint": "7520a6525c910cfc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47675"]}}, {"ruleId": "scanner-794c932c1128b106", "level": "warning", "message": {"text": "CVE-2026-47676: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "7765ea4c6b396474", "scanner": "scanner-primary", "fingerprint": "794c932c1128b106", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47676"]}}, {"ruleId": "scanner-e54600e7a6564646", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "a7e2c0529341dcd3", "scanner": "scanner-primary", "fingerprint": "e54600e7a6564646", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-ae8c1a22e83a8b2e", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "f78239faa4022e60", "scanner": "scanner-primary", "fingerprint": "ae8c1a22e83a8b2e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-8ce4fd65cd7ef21e", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "a461294f1d81f962", "scanner": "scanner-primary", "fingerprint": "8ce4fd65cd7ef21e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-edb57df13ff12116", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "cc32546f42337300", "scanner": "scanner-primary", "fingerprint": "edb57df13ff12116", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-74a524c749764a5e", "level": "warning", "message": {"text": "CVE-2026-56761: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "e2b1674a8fd6e16f", "scanner": "scanner-primary", "fingerprint": "74a524c749764a5e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56761"]}}, {"ruleId": "scanner-1958e4f2ad18ee58", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "e25605e1692b46a7", "scanner": "scanner-primary", "fingerprint": "1958e4f2ad18ee58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-9150f28e9f24755f", "level": "warning", "message": {"text": "CVE-2026-59896: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "980ba75432b32614", "scanner": "scanner-primary", "fingerprint": "9150f28e9f24755f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59896"]}}, {"ruleId": "scanner-ced78e404532d402", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "ea211495a855df92", "scanner": "scanner-primary", "fingerprint": "ced78e404532d402", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-d68764d989539537", "level": "warning", "message": {"text": "CVE-2026-69207: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "88c27b90c1729074", "scanner": "scanner-primary", "fingerprint": "d68764d989539537", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69207"]}}, {"ruleId": "scanner-fffa5653d8ce3c7e", "level": "warning", "message": {"text": "CVE-2026-71848: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "d813a8b1f14a9686", "scanner": "scanner-primary", "fingerprint": "fffa5653d8ce3c7e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71848"]}}, {"ruleId": "scanner-d92132db179f5429", "level": "warning", "message": {"text": "CVE-2026-71850: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "aac656cfb2c84242", "scanner": "scanner-primary", "fingerprint": "d92132db179f5429", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71850"]}}, {"ruleId": "scanner-16147670a44d690a", "level": "warning", "message": {"text": "CVE-2026-84363: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "58a9a2db64980701", "scanner": "scanner-primary", "fingerprint": "16147670a44d690a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84363"]}}, {"ruleId": "scanner-76c9736bdaca213b", "level": "warning", "message": {"text": "CVE-2026-84364: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "de37946386e37fb9", "scanner": "scanner-primary", "fingerprint": "76c9736bdaca213b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84364"]}}, {"ruleId": "scanner-8ac00cbe9cf0c660", "level": "warning", "message": {"text": "CVE-2026-84365: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "026c03469e4eeb4a", "scanner": "scanner-primary", "fingerprint": "8ac00cbe9cf0c660", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84365"]}}, {"ruleId": "scanner-6d76c33e3f727582", "level": "warning", "message": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "a7b976a7ba775f55", "scanner": "scanner-primary", "fingerprint": "6d76c33e3f727582", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-26pp-8wgv-hjvm"]}}, {"ruleId": "scanner-807b44e7d77c9e01", "level": "note", "message": {"text": "CVE-2026-44459: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "bfca27e77f422b5c", "scanner": "scanner-primary", "fingerprint": "807b44e7d77c9e01", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44459"]}}, {"ruleId": "scanner-d32b47fe9f15cbef", "level": "note", "message": {"text": "CVE-2026-71849: hono 4.12.8 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "3a26af8ffa04e925", "scanner": "scanner-primary", "fingerprint": "d32b47fe9f15cbef", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71849"]}}, {"ruleId": "scanner-7d78805a804a2494", "level": "error", "message": {"text": "CVE-2026-69192: ip-address 10.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "b7f9dff85bc8826d", "scanner": "scanner-primary", "fingerprint": "7d78805a804a2494", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69192"]}}, {"ruleId": "scanner-d3b8072be4c69c50", "level": "warning", "message": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "6a5cab764765e560", "scanner": "scanner-primary", "fingerprint": "d3b8072be4c69c50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42338"]}}, {"ruleId": "scanner-75a332aede28835f", "level": "error", "message": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "f980d849867416f2", "scanner": "scanner-primary", "fingerprint": "75a332aede28835f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4867"]}}, {"ruleId": "scanner-bf4da76dd772425d", "level": "error", "message": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "92300c75fe7daa58", "scanner": "scanner-primary", "fingerprint": "bf4da76dd772425d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4926"]}}, {"ruleId": "scanner-de07ea47602e8c44", "level": "warning", "message": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "e16426e47b86c1fd", "scanner": "scanner-primary", "fingerprint": "de07ea47602e8c44", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4923"]}}, {"ruleId": "scanner-f836ba4b72b823e2", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "07abe190a5790658", "scanner": "scanner-primary", "fingerprint": "f836ba4b72b823e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-6cb6ab9bb55a304d", "level": "warning", "message": {"text": "CVE-2026-82562: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "360ec71cefe01e20", "scanner": "scanner-primary", "fingerprint": "6cb6ab9bb55a304d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82562"]}}, {"ruleId": "scanner-d4946bcb1a8d0ea5", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.14.2 \u2014 futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package-lock.json"}, "properties": {"repobilityId": "460d42a5bacd6696", "scanner": "scanner-primary", "fingerprint": "d4946bcb1a8d0ea5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-7403d6789c87a159", "level": "error", "message": {"text": "CVE-2026-27962: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "92dcb2f79ad8abf3", "scanner": "scanner-primary", "fingerprint": "7403d6789c87a159", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27962"]}}, {"ruleId": "scanner-d53b0566d8fcba56", "level": "error", "message": {"text": "CVE-2026-28490: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9e2e3937edb8e469", "scanner": "scanner-primary", "fingerprint": "d53b0566d8fcba56", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28490"]}}, {"ruleId": "scanner-a025c4cf45c2e99c", "level": "error", "message": {"text": "CVE-2026-28498: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "58aba3bdec9c0164", "scanner": "scanner-primary", "fingerprint": "a025c4cf45c2e99c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28498"]}}, {"ruleId": "scanner-be9e3b57d84e2d1a", "level": "error", "message": {"text": "CVE-2026-28802: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "004604b580cd683f", "scanner": "scanner-primary", "fingerprint": "be9e3b57d84e2d1a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28802"]}}, {"ruleId": "scanner-bc82698d965a9730", "level": "warning", "message": {"text": "CVE-2026-41425: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f778ddb7d4c619c3", "scanner": "scanner-primary", "fingerprint": "bc82698d965a9730", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41425"]}}, {"ruleId": "scanner-203bf8ca0a03e3fb", "level": "warning", "message": {"text": "CVE-2026-41479: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "7db3cbe2d9d83d05", "scanner": "scanner-primary", "fingerprint": "203bf8ca0a03e3fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41479"]}}, {"ruleId": "scanner-53f0b6d4ac93bf24", "level": "warning", "message": {"text": "CVE-2026-44681: authlib 1.6.6 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b51f496403886097", "scanner": "scanner-primary", "fingerprint": "53f0b6d4ac93bf24", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44681"]}}, {"ruleId": "scanner-c4e99c36ef2cf196", "level": "error", "message": {"text": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "380e5f5c8da39073", "scanner": "scanner-primary", "fingerprint": "c4e99c36ef2cf196", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26209"]}}, {"ruleId": "scanner-91d7639be26dfbd9", "level": "error", "message": {"text": "CVE-2026-45829: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4db157e7b1980a14", "scanner": "scanner-primary", "fingerprint": "91d7639be26dfbd9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45829"]}}, {"ruleId": "scanner-a27b67a1f3e51376", "level": "error", "message": {"text": "CVE-2026-45833: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "10e833d8e420edef", "scanner": "scanner-primary", "fingerprint": "a27b67a1f3e51376", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45833"]}}, {"ruleId": "scanner-9fd8799991f16907", "level": "error", "message": {"text": "CVE-2026-45830: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "397087eb7a3cc9c4", "scanner": "scanner-primary", "fingerprint": "9fd8799991f16907", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45830"]}}, {"ruleId": "scanner-3d0c0257ecda4e44", "level": "error", "message": {"text": "CVE-2026-45831: chromadb 1.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "2e581c10c43d7933", "scanner": "scanner-primary", "fingerprint": "3d0c0257ecda4e44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45831"]}}, {"ruleId": "scanner-c315f20d266ae4c7", "level": "error", "message": {"text": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f9d8a82176e7a92d", "scanner": "scanner-primary", "fingerprint": "c315f20d266ae4c7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69247"]}}, {"ruleId": "scanner-e40d5da0911617ec", "level": "error", "message": {"text": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "05be7f6724cebbdc", "scanner": "scanner-primary", "fingerprint": "e40d5da0911617ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69249"]}}, {"ruleId": "scanner-7087e35e26afea4c", "level": "error", "message": {"text": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d47fb5d2b7eff712", "scanner": "scanner-primary", "fingerprint": "7087e35e26afea4c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-537c-gmf6-5ccf"]}}, {"ruleId": "scanner-170fe4b16465570a", "level": "warning", "message": {"text": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d34608de8e7c9127", "scanner": "scanner-primary", "fingerprint": "170fe4b16465570a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39892"]}}, {"ruleId": "scanner-fb35fa0ce026e14c", "level": "warning", "message": {"text": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "315aced097d3a077", "scanner": "scanner-primary", "fingerprint": "fb35fa0ce026e14c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69248"]}}, {"ruleId": "scanner-cbe40610e7e0697d", "level": "note", "message": {"text": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4614c5987a4eebaa", "scanner": "scanner-primary", "fingerprint": "cbe40610e7e0697d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34073"]}}, {"ruleId": "scanner-20c1ef61acc332dc", "level": "error", "message": {"text": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c61039350f7cd209", "scanner": "scanner-primary", "fingerprint": "20c1ef61acc332dc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64459"]}}, {"ruleId": "scanner-15b84f37dbab6617", "level": "error", "message": {"text": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "31f4baace9c10cab", "scanner": "scanner-primary", "fingerprint": "15b84f37dbab6617", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57833"]}}, {"ruleId": "scanner-23a09a6d76d6c4a0", "level": "error", "message": {"text": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ab32346b5ec08b5d", "scanner": "scanner-primary", "fingerprint": "23a09a6d76d6c4a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59681"]}}, {"ruleId": "scanner-851da6c6f6a82f49", "level": "error", "message": {"text": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "79b458f3fb730dff", "scanner": "scanner-primary", "fingerprint": "851da6c6f6a82f49", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64458"]}}, {"ruleId": "scanner-7d2a7e8d44d1482c", "level": "warning", "message": {"text": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4d614dc83ba277ac", "scanner": "scanner-primary", "fingerprint": "7d2a7e8d44d1482c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13372"]}}, {"ruleId": "scanner-cef6398b30412d43", "level": "warning", "message": {"text": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d223af73aa97ec7e", "scanner": "scanner-primary", "fingerprint": "cef6398b30412d43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-32873"]}}, {"ruleId": "scanner-3cde8d21bfb943ba", "level": "warning", "message": {"text": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a6e244390a14e885", "scanner": "scanner-primary", "fingerprint": "3cde8d21bfb943ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-48432"]}}, {"ruleId": "scanner-6353bcbfc6d3e299", "level": "warning", "message": {"text": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4faeb669de3ee8e1", "scanner": "scanner-primary", "fingerprint": "6353bcbfc6d3e299", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64460"]}}, {"ruleId": "scanner-0435ec19c74f6f41", "level": "warning", "message": {"text": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b8819a2876935281", "scanner": "scanner-primary", "fingerprint": "0435ec19c74f6f41", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53877"]}}, {"ruleId": "scanner-5447b3ba00b772bc", "level": "warning", "message": {"text": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "cc2911376faa13ff", "scanner": "scanner-primary", "fingerprint": "5447b3ba00b772bc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53878"]}}, {"ruleId": "scanner-0126b8bd6388f0bf", "level": "note", "message": {"text": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "7f102eeb05ba6822", "scanner": "scanner-primary", "fingerprint": "0126b8bd6388f0bf", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59682"]}}, {"ruleId": "scanner-817e12c2a2986bab", "level": "note", "message": {"text": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "efdc393a8d880205", "scanner": "scanner-primary", "fingerprint": "817e12c2a2986bab", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48587"]}}, {"ruleId": "scanner-7c63fffa78edf8d7", "level": "note", "message": {"text": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "121773ab644c97e2", "scanner": "scanner-primary", "fingerprint": "7c63fffa78edf8d7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48588"]}}, {"ruleId": "scanner-cf0f07d93ef19ac8", "level": "note", "message": {"text": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d0aeef157f808cd6", "scanner": "scanner-primary", "fingerprint": "cf0f07d93ef19ac8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6873"]}}, {"ruleId": "scanner-098ba5400736285e", "level": "note", "message": {"text": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ef50500bad1f79fe", "scanner": "scanner-primary", "fingerprint": "098ba5400736285e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8404"]}}, {"ruleId": "scanner-ce6293677cb294b9", "level": "warning", "message": {"text": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a0f3de6d7ab08b44", "scanner": "scanner-primary", "fingerprint": "ce6293677cb294b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73228"]}}, {"ruleId": "scanner-2b572698a12b14e4", "level": "warning", "message": {"text": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "5fb13091626d435e", "scanner": "scanner-primary", "fingerprint": "2b572698a12b14e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73229"]}}, {"ruleId": "scanner-daec31f7679e7ab0", "level": "error", "message": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "36f9fbf51e01d08a", "scanner": "scanner-primary", "fingerprint": "daec31f7679e7ab0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-23342"]}}, {"ruleId": "scanner-adcda7a751ff5b19", "level": "warning", "message": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f6d1c56d151ea69c", "scanner": "scanner-primary", "fingerprint": "adcda7a751ff5b19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33936"]}}, {"ruleId": "scanner-b5da4eba8f1d9edd", "level": "error", "message": {"text": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "946f5be6b0425cee", "scanner": "scanner-primary", "fingerprint": "b5da4eba8f1d9edd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42544"]}}, {"ruleId": "scanner-9a1460fdbe10e0d1", "level": "warning", "message": {"text": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "2be7d94f336f2704", "scanner": "scanner-primary", "fingerprint": "9a1460fdbe10e0d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42545"]}}, {"ruleId": "scanner-7e9b32e9e827d05b", "level": "warning", "message": {"text": "CVE-2026-71554: h2 4.3.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8daf4f426c603787", "scanner": "scanner-primary", "fingerprint": "7e9b32e9e827d05b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71554"]}}, {"ruleId": "scanner-8d25641225374430", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a88e1fa5d77f7ee3", "scanner": "scanner-primary", "fingerprint": "8d25641225374430", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-0c0f88b876575685", "level": "error", "message": {"text": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "509b7374800e3998", "scanner": "scanner-primary", "fingerprint": "0c0f88b876575685", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xf7x-x43h-rpqh"]}}, {"ruleId": "scanner-47ca8c308856efb4", "level": "error", "message": {"text": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "919eb8cc669bd0dc", "scanner": "scanner-primary", "fingerprint": "47ca8c308856efb4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-f7365b4b83b8e1c4", "level": "warning", "message": {"text": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a44dff0b2cfb48c7", "scanner": "scanner-primary", "fingerprint": "f7365b4b83b8e1c4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55443"]}}, {"ruleId": "scanner-9877a9ee34dff1f3", "level": "error", "message": {"text": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ba1bcf7517c5f281", "scanner": "scanner-primary", "fingerprint": "9877a9ee34dff1f3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34070"]}}, {"ruleId": "scanner-dfca5ce7e748f697", "level": "error", "message": {"text": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c55175a7162d7176", "scanner": "scanner-primary", "fingerprint": "dfca5ce7e748f697", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44843"]}}, {"ruleId": "scanner-af415482b00ba536", "level": "warning", "message": {"text": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "961d694ef09e9835", "scanner": "scanner-primary", "fingerprint": "af415482b00ba536", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40087"]}}, {"ruleId": "scanner-aaf556935fc094a8", "level": "note", "message": {"text": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "2b36f5f80e36caa9", "scanner": "scanner-primary", "fingerprint": "aaf556935fc094a8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26013"]}}, {"ruleId": "scanner-d1f4f692f76f8ff7", "level": "warning", "message": {"text": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "3998c040bcf388b9", "scanner": "scanner-primary", "fingerprint": "d1f4f692f76f8ff7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41481"]}}, {"ruleId": "scanner-724d7e90aa2c54c7", "level": "error", "message": {"text": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "99844d482a1db01b", "scanner": "scanner-primary", "fingerprint": "724d7e90aa2c54c7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-9c84e7f9cf4f98d6", "level": "error", "message": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "7bb7149c343444de", "scanner": "scanner-primary", "fingerprint": "9c84e7f9cf4f98d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f4xh-w4cj-qxq8"]}}, {"ruleId": "scanner-da055c4ad365ccc8", "level": "warning", "message": {"text": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6abf3c7fbd1738f2", "scanner": "scanner-primary", "fingerprint": "da055c4ad365ccc8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41182"]}}, {"ruleId": "scanner-22ffadb0ac722f70", "level": "error", "message": {"text": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8164edc3a70ef3b9", "scanner": "scanner-primary", "fingerprint": "22ffadb0ac722f70", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35030"]}}, {"ruleId": "scanner-8e5544e96dd18b17", "level": "error", "message": {"text": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8267d1f176f36dfa", "scanner": "scanner-primary", "fingerprint": "8e5544e96dd18b17", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-37004"]}}, {"ruleId": "scanner-69aea02219862dbb", "level": "error", "message": {"text": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "19e8515e688ada0f", "scanner": "scanner-primary", "fingerprint": "69aea02219862dbb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49468"]}}, {"ruleId": "scanner-2ebedd8d33a8c056", "level": "error", "message": {"text": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "5cce68a18302d5d6", "scanner": "scanner-primary", "fingerprint": "2ebedd8d33a8c056", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35029"]}}, {"ruleId": "scanner-723adbfa8f7b9fc5", "level": "error", "message": {"text": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c9b4168b34e91340", "scanner": "scanner-primary", "fingerprint": "723adbfa8f7b9fc5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40217"]}}, {"ruleId": "scanner-19d5390162a4cac9", "level": "error", "message": {"text": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "21171399d6960f51", "scanner": "scanner-primary", "fingerprint": "19d5390162a4cac9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42203"]}}, {"ruleId": "scanner-ceec67e294922a5a", "level": "error", "message": {"text": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "570b599902e618ee", "scanner": "scanner-primary", "fingerprint": "ceec67e294922a5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42271"]}}, {"ruleId": "scanner-03c765f698b35d17", "level": "error", "message": {"text": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "7a7c5bbb19fd3913", "scanner": "scanner-primary", "fingerprint": "03c765f698b35d17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47101"]}}, {"ruleId": "scanner-7a8138a3574a9010", "level": "error", "message": {"text": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "895112ebfc827e97", "scanner": "scanner-primary", "fingerprint": "7a8138a3574a9010", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47102"]}}, {"ruleId": "scanner-05e6204484ba6e5a", "level": "error", "message": {"text": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "daeab4f838f12cda", "scanner": "scanner-primary", "fingerprint": "05e6204484ba6e5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59822"]}}, {"ruleId": "scanner-60a762076e69252b", "level": "error", "message": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "fc330ea025b7b832", "scanner": "scanner-primary", "fingerprint": "60a762076e69252b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-69x8-hrgq-fjj8"]}}, {"ruleId": "scanner-35a5df3e4858b498", "level": "warning", "message": {"text": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "374cc045372bf767", "scanner": "scanner-primary", "fingerprint": "35a5df3e4858b498", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12773"]}}, {"ruleId": "scanner-590d825e9b615d3f", "level": "warning", "message": {"text": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "cf3d4656fbbef560", "scanner": "scanner-primary", "fingerprint": "590d825e9b615d3f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12795"]}}, {"ruleId": "scanner-bfce18fc6f4b306e", "level": "warning", "message": {"text": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "0460d943952c48a6", "scanner": "scanner-primary", "fingerprint": "bfce18fc6f4b306e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59820"]}}, {"ruleId": "scanner-868991f781ed961e", "level": "warning", "message": {"text": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "172378c0cc8fd9f2", "scanner": "scanner-primary", "fingerprint": "868991f781ed961e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59823"]}}, {"ruleId": "scanner-0528578b60a4d9a3", "level": "note", "message": {"text": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b532f12ff813e458", "scanner": "scanner-primary", "fingerprint": "0528578b60a4d9a3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12771"]}}, {"ruleId": "scanner-a7dbdb4f3c3a78eb", "level": "note", "message": {"text": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "dceffe81e911e2e1", "scanner": "scanner-primary", "fingerprint": "a7dbdb4f3c3a78eb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12772"]}}, {"ruleId": "scanner-8a133fe1ffe9574b", "level": "note", "message": {"text": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d5063b195021c34d", "scanner": "scanner-primary", "fingerprint": "8a133fe1ffe9574b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12796"]}}, {"ruleId": "scanner-c201bc42c816beab", "level": "note", "message": {"text": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "101d685ee008cb89", "scanner": "scanner-primary", "fingerprint": "c201bc42c816beab", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12797"]}}, {"ruleId": "scanner-8d3d0e2636870bdc", "level": "note", "message": {"text": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c6357c27a9074cdb", "scanner": "scanner-primary", "fingerprint": "8d3d0e2636870bdc", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12798"]}}, {"ruleId": "scanner-4d15e5c4e05bc0a3", "level": "note", "message": {"text": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "0991cead767e9c3f", "scanner": "scanner-primary", "fingerprint": "4d15e5c4e05bc0a3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12799"]}}, {"ruleId": "scanner-528241251767bf24", "level": "note", "message": {"text": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "70f0024b69d49f0d", "scanner": "scanner-primary", "fingerprint": "528241251767bf24", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59819"]}}, {"ruleId": "scanner-d8936c00394f8c33", "level": "note", "message": {"text": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "5dc4cb2305a60f8a", "scanner": "scanner-primary", "fingerprint": "d8936c00394f8c33", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59821"]}}, {"ruleId": "scanner-7630e0de561cb6d7", "level": "error", "message": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "2dd55760e9db8776", "scanner": "scanner-primary", "fingerprint": "7630e0de561cb6d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41066"]}}, {"ruleId": "scanner-26df05ff8a822ee1", "level": "error", "message": {"text": "CVE-2026-41205: mako 1.3.10 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "da47ecd2d8f25a62", "scanner": "scanner-primary", "fingerprint": "26df05ff8a822ee1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41205"]}}, {"ruleId": "scanner-5e8eecdd8c52db21", "level": "error", "message": {"text": "CVE-2026-44307: mako 1.3.10 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "83141de852b6d3f6", "scanner": "scanner-primary", "fingerprint": "5e8eecdd8c52db21", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44307"]}}, {"ruleId": "scanner-39b3fc43bd0ae4bf", "level": "error", "message": {"text": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "3fb3099234e624d1", "scanner": "scanner-primary", "fingerprint": "39b3fc43bd0ae4bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-52869"]}}, {"ruleId": "scanner-e2acf0c78b6b05b0", "level": "error", "message": {"text": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "15eba57407d22abb", "scanner": "scanner-primary", "fingerprint": "e2acf0c78b6b05b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-52870"]}}, {"ruleId": "scanner-b44ade8353ff5370", "level": "error", "message": {"text": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6ac9642403663887", "scanner": "scanner-primary", "fingerprint": "b44ade8353ff5370", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59950"]}}, {"ruleId": "scanner-ab6c60b6ae48890b", "level": "error", "message": {"text": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a8d48e4f6796f30d", "scanner": "scanner-primary", "fingerprint": "ab6c60b6ae48890b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-6v7p-g79w-8964"]}}, {"ruleId": "scanner-91d076a985aa77d5", "level": "error", "message": {"text": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "210b167ec020a828", "scanner": "scanner-primary", "fingerprint": "91d076a985aa77d5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-14009"]}}, {"ruleId": "scanner-e1a1aa198aa53152", "level": "error", "message": {"text": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c945c86283fe9f73", "scanner": "scanner-primary", "fingerprint": "e1a1aa198aa53152", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78683"]}}, {"ruleId": "scanner-e2312811de055e4b", "level": "error", "message": {"text": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f4fa419f4f22299c", "scanner": "scanner-primary", "fingerprint": "e2312811de055e4b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79657"]}}, {"ruleId": "scanner-bb2238de44b55cbb", "level": "error", "message": {"text": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "bd3fd0ef3878bd7c", "scanner": "scanner-primary", "fingerprint": "bb2238de44b55cbb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79675"]}}, {"ruleId": "scanner-0361d4041c41434c", "level": "error", "message": {"text": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "1d2d20608b5288ce", "scanner": "scanner-primary", "fingerprint": "0361d4041c41434c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71408"]}}, {"ruleId": "scanner-5c441bf57f7797f9", "level": "error", "message": {"text": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d9b137162ab4f953", "scanner": "scanner-primary", "fingerprint": "5c441bf57f7797f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0846"]}}, {"ruleId": "scanner-b72090d3ff09e890", "level": "error", "message": {"text": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "53c40bee9197f29c", "scanner": "scanner-primary", "fingerprint": "b72090d3ff09e890", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0847"]}}, {"ruleId": "scanner-b11b7d5783150482", "level": "error", "message": {"text": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "105e45b559cfc364", "scanner": "scanner-primary", "fingerprint": "b11b7d5783150482", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12061"]}}, {"ruleId": "scanner-395e920b9763704a", "level": "error", "message": {"text": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "1f9651725da0435a", "scanner": "scanner-primary", "fingerprint": "395e920b9763704a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12072"]}}, {"ruleId": "scanner-25988f0e9cfe6f00", "level": "error", "message": {"text": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c4c0bda9b67f4259", "scanner": "scanner-primary", "fingerprint": "25988f0e9cfe6f00", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12074"]}}, {"ruleId": "scanner-85e369860d142bbf", "level": "error", "message": {"text": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "efe9a64c88803580", "scanner": "scanner-primary", "fingerprint": "85e369860d142bbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12075"]}}, {"ruleId": "scanner-d076408a1b334699", "level": "error", "message": {"text": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "02e0b19f692cac53", "scanner": "scanner-primary", "fingerprint": "d076408a1b334699", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33231"]}}, {"ruleId": "scanner-984bdbf134029e7f", "level": "error", "message": {"text": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6e6f54731c1f8545", "scanner": "scanner-primary", "fingerprint": "984bdbf134029e7f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33236"]}}, {"ruleId": "scanner-8a8d2dc541923377", "level": "error", "message": {"text": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "5d50fa2a89fae8f4", "scanner": "scanner-primary", "fingerprint": "8a8d2dc541923377", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54293"]}}, {"ruleId": "scanner-9824cedaee214cbf", "level": "error", "message": {"text": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "37757af50988c0b1", "scanner": "scanner-primary", "fingerprint": "9824cedaee214cbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-62385"]}}, {"ruleId": "scanner-9e92ba1a528f8c20", "level": "error", "message": {"text": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a24fccf7e094137f", "scanner": "scanner-primary", "fingerprint": "9e92ba1a528f8c20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-62388"]}}, {"ruleId": "scanner-ea177af24fde223d", "level": "error", "message": {"text": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "3edb769122e11ead", "scanner": "scanner-primary", "fingerprint": "ea177af24fde223d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-63312"]}}, {"ruleId": "scanner-f533634ac42a7952", "level": "error", "message": {"text": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "1651132b7b072f26", "scanner": "scanner-primary", "fingerprint": "f533634ac42a7952", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-70626"]}}, {"ruleId": "scanner-9b9ecec1573feb38", "level": "error", "message": {"text": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4fd35ec428ae0d46", "scanner": "scanner-primary", "fingerprint": "9b9ecec1573feb38", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-72818"]}}, {"ruleId": "scanner-e6a3c2a74e2a0104", "level": "error", "message": {"text": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "714c6afd159d87fe", "scanner": "scanner-primary", "fingerprint": "e6a3c2a74e2a0104", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78680"]}}, {"ruleId": "scanner-5aefd0c121756629", "level": "error", "message": {"text": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "eb8433f1f6d25cb2", "scanner": "scanner-primary", "fingerprint": "5aefd0c121756629", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78681"]}}, {"ruleId": "scanner-4434400848423c2f", "level": "error", "message": {"text": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "47dc4443407ed921", "scanner": "scanner-primary", "fingerprint": "4434400848423c2f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78682"]}}, {"ruleId": "scanner-36e27e0febd6bab9", "level": "error", "message": {"text": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "355d3af54a2d56a9", "scanner": "scanner-primary", "fingerprint": "36e27e0febd6bab9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79674"]}}, {"ruleId": "scanner-527e096dc343b364", "level": "error", "message": {"text": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "43249d48d984cb6c", "scanner": "scanner-primary", "fingerprint": "527e096dc343b364", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79676"]}}, {"ruleId": "scanner-d53399ab88ce2e23", "level": "error", "message": {"text": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "41b7d91c9142f23d", "scanner": "scanner-primary", "fingerprint": "d53399ab88ce2e23", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-80205"]}}, {"ruleId": "scanner-8f5cdb9713b14e6c", "level": "error", "message": {"text": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b1d5478c8b19c121", "scanner": "scanner-primary", "fingerprint": "8f5cdb9713b14e6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-80206"]}}, {"ruleId": "scanner-91178a847a302876", "level": "error", "message": {"text": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "30bc8128e1a772d4", "scanner": "scanner-primary", "fingerprint": "91178a847a302876", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81726"]}}, {"ruleId": "scanner-fbab559305a32fc2", "level": "warning", "message": {"text": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "543a220faf846810", "scanner": "scanner-primary", "fingerprint": "fbab559305a32fc2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12259"]}}, {"ruleId": "scanner-c9ef0765b5561f78", "level": "warning", "message": {"text": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9d60cefaf2d6e8ce", "scanner": "scanner-primary", "fingerprint": "c9ef0765b5561f78", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12876"]}}, {"ruleId": "scanner-9ecb0427ace2a2b0", "level": "warning", "message": {"text": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ae702ed2398bf358", "scanner": "scanner-primary", "fingerprint": "9ecb0427ace2a2b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33230"]}}, {"ruleId": "scanner-250b9fb4dc974dca", "level": "warning", "message": {"text": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "631c9a0524cb155e", "scanner": "scanner-primary", "fingerprint": "250b9fb4dc974dca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-63311"]}}, {"ruleId": "scanner-d69b1bb6fc20aa32", "level": "warning", "message": {"text": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f0982f41c13e724c", "scanner": "scanner-primary", "fingerprint": "d69b1bb6fc20aa32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65915"]}}, {"ruleId": "scanner-d2be0d410dc7196a", "level": "warning", "message": {"text": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "eacc295989132f52", "scanner": "scanner-primary", "fingerprint": "d2be0d410dc7196a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-66393"]}}, {"ruleId": "scanner-6af0e2f08dea5039", "level": "warning", "message": {"text": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f2b286001e5d820d", "scanner": "scanner-primary", "fingerprint": "6af0e2f08dea5039", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81722"]}}, {"ruleId": "scanner-b65c4e0326e54748", "level": "warning", "message": {"text": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "35d90c9661fd6fcc", "scanner": "scanner-primary", "fingerprint": "b65c4e0326e54748", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81723"]}}, {"ruleId": "scanner-5d4a1ff3d7f7748f", "level": "warning", "message": {"text": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "bb7cfd9822d11db5", "scanner": "scanner-primary", "fingerprint": "5d4a1ff3d7f7748f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81724"]}}, {"ruleId": "scanner-e6a33bad7b21e976", "level": "warning", "message": {"text": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "67f04707b9116f64", "scanner": "scanner-primary", "fingerprint": "e6a33bad7b21e976", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81725"]}}, {"ruleId": "scanner-648b0efa6be911ad", "level": "warning", "message": {"text": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "63c5a8434856e452", "scanner": "scanner-primary", "fingerprint": "648b0efa6be911ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81727"]}}, {"ruleId": "scanner-17fc94d08c24200e", "level": "error", "message": {"text": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e16dfca5986a3da4", "scanner": "scanner-primary", "fingerprint": "17fc94d08c24200e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-67221"]}}, {"ruleId": "scanner-63c2c6b2a72d8517", "level": "error", "message": {"text": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a4f62122952fd8bc", "scanner": "scanner-primary", "fingerprint": "63c2c6b2a72d8517", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25990"]}}, {"ruleId": "scanner-88ab219e4bde63cc", "level": "error", "message": {"text": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "eb8aafc8d798115f", "scanner": "scanner-primary", "fingerprint": "88ab219e4bde63cc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40192"]}}, {"ruleId": "scanner-634e445bf858711d", "level": "error", "message": {"text": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8dd0ba4856ba81e5", "scanner": "scanner-primary", "fingerprint": "634e445bf858711d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42311"]}}, {"ruleId": "scanner-1b66b3344033fe00", "level": "error", "message": {"text": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "054990f303e636c0", "scanner": "scanner-primary", "fingerprint": "1b66b3344033fe00", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54058"]}}, {"ruleId": "scanner-5d8a6875cb92855b", "level": "error", "message": {"text": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "90bb21f08ffca8a2", "scanner": "scanner-primary", "fingerprint": "5d8a6875cb92855b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54059"]}}, {"ruleId": "scanner-5408e642682665bd", "level": "error", "message": {"text": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9bdd6ed83d513323", "scanner": "scanner-primary", "fingerprint": "5408e642682665bd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54060"]}}, {"ruleId": "scanner-837457bd0f047b72", "level": "error", "message": {"text": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8121d53a797def03", "scanner": "scanner-primary", "fingerprint": "837457bd0f047b72", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55379"]}}, {"ruleId": "scanner-4d2c3191b3919703", "level": "error", "message": {"text": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6594ae06aa296a74", "scanner": "scanner-primary", "fingerprint": "4d2c3191b3919703", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55380"]}}, {"ruleId": "scanner-445be665272ba1f3", "level": "error", "message": {"text": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e305915b8541e142", "scanner": "scanner-primary", "fingerprint": "445be665272ba1f3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59197"]}}, {"ruleId": "scanner-9ccd3b15c90bdc43", "level": "error", "message": {"text": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e2db5b31e0cbdcdb", "scanner": "scanner-primary", "fingerprint": "9ccd3b15c90bdc43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59199"]}}, {"ruleId": "scanner-c201f0b8c17cdb13", "level": "error", "message": {"text": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "0aacfc8cd4643eda", "scanner": "scanner-primary", "fingerprint": "c201f0b8c17cdb13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59200"]}}, {"ruleId": "scanner-d5afdf2436bf7044", "level": "error", "message": {"text": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "babb3fee422c591d", "scanner": "scanner-primary", "fingerprint": "d5afdf2436bf7044", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59204"]}}, {"ruleId": "scanner-2187c8a997481b45", "level": "error", "message": {"text": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "432bf76513a153b3", "scanner": "scanner-primary", "fingerprint": "2187c8a997481b45", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59205"]}}, {"ruleId": "scanner-5401493967d6bca8", "level": "warning", "message": {"text": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ffd305ab0f3095f6", "scanner": "scanner-primary", "fingerprint": "5401493967d6bca8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42308"]}}, {"ruleId": "scanner-21babde5e19d13a2", "level": "warning", "message": {"text": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f08c1d2c7017ca7e", "scanner": "scanner-primary", "fingerprint": "21babde5e19d13a2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42309"]}}, {"ruleId": "scanner-81b1c5f86e542027", "level": "warning", "message": {"text": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b13d481f777c1252", "scanner": "scanner-primary", "fingerprint": "81b1c5f86e542027", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42310"]}}, {"ruleId": "scanner-053425802a7e5677", "level": "warning", "message": {"text": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "955fdf67d78a0fd4", "scanner": "scanner-primary", "fingerprint": "053425802a7e5677", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55798"]}}, {"ruleId": "scanner-ad583960fd9ee56f", "level": "warning", "message": {"text": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "eaa979636cfb7209", "scanner": "scanner-primary", "fingerprint": "ad583960fd9ee56f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59198"]}}, {"ruleId": "scanner-d4111400be3e481a", "level": "warning", "message": {"text": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "94a7eea7bfe6f09e", "scanner": "scanner-primary", "fingerprint": "d4111400be3e481a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59203"]}}, {"ruleId": "scanner-d82e4329eb98050f", "level": "error", "message": {"text": "CVE-2026-25087: pyarrow 22.0.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "88d545e452f8e4fb", "scanner": "scanner-primary", "fingerprint": "d82e4329eb98050f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25087"]}}, {"ruleId": "scanner-eb4950ae866d9e64", "level": "error", "message": {"text": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a7012ee20d653b9f", "scanner": "scanner-primary", "fingerprint": "eb4950ae866d9e64", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23490"]}}, {"ruleId": "scanner-15cf9a3281644c2f", "level": "error", "message": {"text": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "046f1a904201795b", "scanner": "scanner-primary", "fingerprint": "15cf9a3281644c2f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-30922"]}}, {"ruleId": "scanner-af51cdfb472a5ed7", "level": "error", "message": {"text": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8ebe71a1548710e7", "scanner": "scanner-primary", "fingerprint": "af51cdfb472a5ed7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59884"]}}, {"ruleId": "scanner-117aaac109e590bc", "level": "error", "message": {"text": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f1a3f38f0d2fb285", "scanner": "scanner-primary", "fingerprint": "117aaac109e590bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59885"]}}, {"ruleId": "scanner-9656462a1ca03a86", "level": "error", "message": {"text": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "3c7684f1260b147f", "scanner": "scanner-primary", "fingerprint": "9656462a1ca03a86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59886"]}}, {"ruleId": "scanner-d5d06bc37cf6116c", "level": "warning", "message": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "53674b6a702c0191", "scanner": "scanner-primary", "fingerprint": "d5d06bc37cf6116c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4xgf-cpjx-pc3j"]}}, {"ruleId": "scanner-b1e154b4cf0469b1", "level": "note", "message": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c9ee9808da7fe4e0", "scanner": "scanner-primary", "fingerprint": "b1e154b4cf0469b1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4539"]}}, {"ruleId": "scanner-bed10fa5c02e42b7", "level": "error", "message": {"text": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b6128b27d0e0074d", "scanner": "scanner-primary", "fingerprint": "bed10fa5c02e42b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-32597"]}}, {"ruleId": "scanner-072b71ffaafe0324", "level": "error", "message": {"text": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ef7637e1019de31b", "scanner": "scanner-primary", "fingerprint": "072b71ffaafe0324", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48526"]}}, {"ruleId": "scanner-4fde1b0702434209", "level": "warning", "message": {"text": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "615d3be9c9f413ab", "scanner": "scanner-primary", "fingerprint": "4fde1b0702434209", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48522"]}}, {"ruleId": "scanner-075ddca747b7aa7b", "level": "warning", "message": {"text": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9be372b2ffc79381", "scanner": "scanner-primary", "fingerprint": "075ddca747b7aa7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48523"]}}, {"ruleId": "scanner-d3c0da1b3f6f7835", "level": "warning", "message": {"text": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "266b0e64fe978764", "scanner": "scanner-primary", "fingerprint": "d3c0da1b3f6f7835", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48525"]}}, {"ruleId": "scanner-1bc28a467f6455b3", "level": "note", "message": {"text": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "a212d309b4e99532", "scanner": "scanner-primary", "fingerprint": "1bc28a467f6455b3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48524"]}}, {"ruleId": "scanner-9284009d31987ab9", "level": "error", "message": {"text": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "cf12b9ed5942f975", "scanner": "scanner-primary", "fingerprint": "9284009d31987ab9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59935"]}}, {"ruleId": "scanner-0774ce131821c128", "level": "error", "message": {"text": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ca5b7515eb6b4066", "scanner": "scanner-primary", "fingerprint": "0774ce131821c128", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59936"]}}, {"ruleId": "scanner-2c34f59d7c2844d1", "level": "warning", "message": {"text": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "70de58f1f3bdbc36", "scanner": "scanner-primary", "fingerprint": "2c34f59d7c2844d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24688"]}}, {"ruleId": "scanner-23eeb2e77407944a", "level": "warning", "message": {"text": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ad6e38e41a9a2894", "scanner": "scanner-primary", "fingerprint": "23eeb2e77407944a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27024"]}}, {"ruleId": "scanner-4860ae414739a133", "level": "warning", "message": {"text": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "abbb4ba5f3a10480", "scanner": "scanner-primary", "fingerprint": "4860ae414739a133", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27025"]}}, {"ruleId": "scanner-2a090a6ca71ab747", "level": "warning", "message": {"text": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "117f63f7ec84be80", "scanner": "scanner-primary", "fingerprint": "2a090a6ca71ab747", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27026"]}}, {"ruleId": "scanner-111d18779f92f6de", "level": "warning", "message": {"text": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e4dcea8502ca6bf8", "scanner": "scanner-primary", "fingerprint": "111d18779f92f6de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27888"]}}, {"ruleId": "scanner-b99886cd183df83e", "level": "warning", "message": {"text": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "40791214e1fa19c7", "scanner": "scanner-primary", "fingerprint": "b99886cd183df83e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28351"]}}, {"ruleId": "scanner-1d7e8a32a588616d", "level": "warning", "message": {"text": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "77cd61c6ec1536c8", "scanner": "scanner-primary", "fingerprint": "1d7e8a32a588616d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28804"]}}, {"ruleId": "scanner-1e962dfff4d4d432", "level": "warning", "message": {"text": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9084bc8a3a25ad35", "scanner": "scanner-primary", "fingerprint": "1e962dfff4d4d432", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31826"]}}, {"ruleId": "scanner-85549acd28243908", "level": "warning", "message": {"text": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e61fefd2162a620b", "scanner": "scanner-primary", "fingerprint": "85549acd28243908", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33123"]}}, {"ruleId": "scanner-da384d1eb11684b6", "level": "warning", "message": {"text": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4799f0104cd9caf8", "scanner": "scanner-primary", "fingerprint": "da384d1eb11684b6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33699"]}}, {"ruleId": "scanner-fcb651c55c7f3a31", "level": "warning", "message": {"text": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4518785176aafa45", "scanner": "scanner-primary", "fingerprint": "fcb651c55c7f3a31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40260"]}}, {"ruleId": "scanner-ad8837f1e89450e6", "level": "warning", "message": {"text": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "706d9a7b2a607306", "scanner": "scanner-primary", "fingerprint": "ad8837f1e89450e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41168"]}}, {"ruleId": "scanner-9ec224d2f162f130", "level": "warning", "message": {"text": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "471dfd98c9617749", "scanner": "scanner-primary", "fingerprint": "9ec224d2f162f130", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41312"]}}, {"ruleId": "scanner-a0b3885715c47c03", "level": "warning", "message": {"text": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "cf0d765df1e120c5", "scanner": "scanner-primary", "fingerprint": "a0b3885715c47c03", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41313"]}}, {"ruleId": "scanner-9a7b8d671afc99bf", "level": "warning", "message": {"text": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "449165ef901b1529", "scanner": "scanner-primary", "fingerprint": "9a7b8d671afc99bf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41314"]}}, {"ruleId": "scanner-e965a744bfde0327", "level": "warning", "message": {"text": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9aed0d1e0917a82f", "scanner": "scanner-primary", "fingerprint": "e965a744bfde0327", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48155"]}}, {"ruleId": "scanner-32c88eeb86a804f5", "level": "warning", "message": {"text": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "62587e11336c2ca0", "scanner": "scanner-primary", "fingerprint": "32c88eeb86a804f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48156"]}}, {"ruleId": "scanner-d2e803135b60f400", "level": "warning", "message": {"text": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "3c504393b335d5a5", "scanner": "scanner-primary", "fingerprint": "d2e803135b60f400", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48735"]}}, {"ruleId": "scanner-5d4eeaea3b5a303a", "level": "warning", "message": {"text": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "250ead29d7fee99f", "scanner": "scanner-primary", "fingerprint": "5d4eeaea3b5a303a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49460"]}}, {"ruleId": "scanner-52e54c6ad584504a", "level": "warning", "message": {"text": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "7a89d5cb3e517305", "scanner": "scanner-primary", "fingerprint": "52e54c6ad584504a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49461"]}}, {"ruleId": "scanner-554bf8d98e5e7d96", "level": "warning", "message": {"text": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "ccdb0453e6ba852a", "scanner": "scanner-primary", "fingerprint": "554bf8d98e5e7d96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54530"]}}, {"ruleId": "scanner-0e116478357f8319", "level": "warning", "message": {"text": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "58d6fde025e5103e", "scanner": "scanner-primary", "fingerprint": "0e116478357f8319", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54531"]}}, {"ruleId": "scanner-0c47e72e8728da1d", "level": "warning", "message": {"text": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "dc0a1aa2e3c1ac89", "scanner": "scanner-primary", "fingerprint": "0c47e72e8728da1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54651"]}}, {"ruleId": "scanner-555e7673b0b78204", "level": "warning", "message": {"text": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "b122900b84b1ef36", "scanner": "scanner-primary", "fingerprint": "555e7673b0b78204", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59937"]}}, {"ruleId": "scanner-35760ec505a18d22", "level": "warning", "message": {"text": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "391f4cce32674314", "scanner": "scanner-primary", "fingerprint": "35760ec505a18d22", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59938"]}}, {"ruleId": "scanner-6d460b307fb7d9c0", "level": "warning", "message": {"text": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6a95af6cde92ec33", "scanner": "scanner-primary", "fingerprint": "6d460b307fb7d9c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71852"]}}, {"ruleId": "scanner-154e75a47240cae3", "level": "warning", "message": {"text": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "3ad5ebc435b5e0f8", "scanner": "scanner-primary", "fingerprint": "154e75a47240cae3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71870"]}}, {"ruleId": "scanner-1ef5b7b2ccf955fd", "level": "warning", "message": {"text": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d37ce869aaaa7753", "scanner": "scanner-primary", "fingerprint": "1ef5b7b2ccf955fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82398"]}}, {"ruleId": "scanner-d9f04b09ac40e333", "level": "warning", "message": {"text": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "37ae18f905aa4dbb", "scanner": "scanner-primary", "fingerprint": "d9f04b09ac40e333", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84309"]}}, {"ruleId": "scanner-c1c9891077c0dcf4", "level": "warning", "message": {"text": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8075cad9e06e12d4", "scanner": "scanner-primary", "fingerprint": "c1c9891077c0dcf4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84310"]}}, {"ruleId": "scanner-3d04276e4427ff82", "level": "warning", "message": {"text": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e8c0c27d89e57323", "scanner": "scanner-primary", "fingerprint": "3d04276e4427ff82", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84311"]}}, {"ruleId": "scanner-6961902a15408cc0", "level": "warning", "message": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "df2888e37f2251bf", "scanner": "scanner-primary", "fingerprint": "6961902a15408cc0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jm82-fx9c-mx94"]}}, {"ruleId": "scanner-650ff91903f80600", "level": "note", "message": {"text": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "08a00a5cb8c77b78", "scanner": "scanner-primary", "fingerprint": "650ff91903f80600", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27628"]}}, {"ruleId": "scanner-1692494c7e30d789", "level": "warning", "message": {"text": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f54420e316376091", "scanner": "scanner-primary", "fingerprint": "1692494c7e30d789", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28684"]}}, {"ruleId": "scanner-082a038ab97e8c9c", "level": "warning", "message": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d74e9483fb3baff6", "scanner": "scanner-primary", "fingerprint": "082a038ab97e8c9c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25645"]}}, {"ruleId": "scanner-c6a782f6b1323c9f", "level": "warning", "message": {"text": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "02cb9f2fb66e047a", "scanner": "scanner-primary", "fingerprint": "c6a782f6b1323c9f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59890"]}}, {"ruleId": "scanner-8b9c488592842363", "level": "error", "message": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f5f7f9621634242a", "scanner": "scanner-primary", "fingerprint": "8b9c488592842363", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49476"]}}, {"ruleId": "scanner-690aec8f44237416", "level": "error", "message": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "32a5b65d74338747", "scanner": "scanner-primary", "fingerprint": "690aec8f44237416", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49477"]}}, {"ruleId": "scanner-4252e51b0f08b289", "level": "warning", "message": {"text": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c2171d17fbd8f6de", "scanner": "scanner-primary", "fingerprint": "4252e51b0f08b289", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-85999"]}}, {"ruleId": "scanner-6b1d04ea0a9326cf", "level": "warning", "message": {"text": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "46db42f26f0579e4", "scanner": "scanner-primary", "fingerprint": "6b1d04ea0a9326cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-86000"]}}, {"ruleId": "scanner-a354ea7c22faa90c", "level": "error", "message": {"text": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9e12461548266e71", "scanner": "scanner-primary", "fingerprint": "a354ea7c22faa90c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54284"]}}, {"ruleId": "scanner-d16450b912701dab", "level": "error", "message": {"text": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "e4d7118c37d4b340", "scanner": "scanner-primary", "fingerprint": "d16450b912701dab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59893"]}}, {"ruleId": "scanner-3fdbb73fda3a53ff", "level": "error", "message": {"text": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "81afd15929d5122c", "scanner": "scanner-primary", "fingerprint": "3fdbb73fda3a53ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71491"]}}, {"ruleId": "scanner-18d6f5b616fbcdbe", "level": "warning", "message": {"text": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "f28d8b43881a21ab", "scanner": "scanner-primary", "fingerprint": "18d6f5b616fbcdbe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59894"]}}, {"ruleId": "scanner-273cbd8c25d51321", "level": "warning", "message": {"text": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "91901bd6b1c51cbf", "scanner": "scanner-primary", "fingerprint": "273cbd8c25d51321", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84305"]}}, {"ruleId": "scanner-711a65b9b9ed16d3", "level": "error", "message": {"text": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "53a1ea42bddf6d91", "scanner": "scanner-primary", "fingerprint": "711a65b9b9ed16d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48818"]}}, {"ruleId": "scanner-50f1e3a0f4040205", "level": "error", "message": {"text": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "41f81a540e03b732", "scanner": "scanner-primary", "fingerprint": "50f1e3a0f4040205", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54283"]}}, {"ruleId": "scanner-8e23d135136ca0a1", "level": "warning", "message": {"text": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c07fe5431bd09aeb", "scanner": "scanner-primary", "fingerprint": "8e23d135136ca0a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48710"]}}, {"ruleId": "scanner-15783a39eb247ace", "level": "warning", "message": {"text": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c73d75425e504b0a", "scanner": "scanner-primary", "fingerprint": "15783a39eb247ace", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48817"]}}, {"ruleId": "scanner-e0d8ff758e8b282d", "level": "note", "message": {"text": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "0632c53e336c10c3", "scanner": "scanner-primary", "fingerprint": "e0d8ff758e8b282d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54282"]}}, {"ruleId": "scanner-b5845b4b018a3978", "level": "note", "message": {"text": "CVE-2025-3000: torch 2.11.0 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "4300fb24e1f239ae", "scanner": "scanner-primary", "fingerprint": "b5845b4b018a3978", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3000"]}}, {"ruleId": "scanner-f3678b0900e40a50", "level": "error", "message": {"text": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "c974ee4e881c8341", "scanner": "scanner-primary", "fingerprint": "f3678b0900e40a50", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31958"]}}, {"ruleId": "scanner-097f09fe79f0ed48", "level": "error", "message": {"text": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6e7cb541de184ecb", "scanner": "scanner-primary", "fingerprint": "097f09fe79f0ed48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35536"]}}, {"ruleId": "scanner-d1d048eee5c63ed5", "level": "error", "message": {"text": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "23d3e31adb19ca5d", "scanner": "scanner-primary", "fingerprint": "d1d048eee5c63ed5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49853"]}}, {"ruleId": "scanner-70fb25e44c152b9a", "level": "error", "message": {"text": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "d14e399a52cb0cd1", "scanner": "scanner-primary", "fingerprint": "70fb25e44c152b9a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49855"]}}, {"ruleId": "scanner-d9893a7e7ed15e60", "level": "error", "message": {"text": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "efd0cba07f08b707", "scanner": "scanner-primary", "fingerprint": "d9893a7e7ed15e60", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82397"]}}, {"ruleId": "scanner-39177168b4f2de5e", "level": "warning", "message": {"text": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "8cd2de50cccafde3", "scanner": "scanner-primary", "fingerprint": "39177168b4f2de5e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-78cv-mqj4-43f7"]}}, {"ruleId": "scanner-3378d11e59c11396", "level": "warning", "message": {"text": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "5d0592b9441ada0a", "scanner": "scanner-primary", "fingerprint": "3378d11e59c11396", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8423-8fgw-73vq"]}}, {"ruleId": "scanner-afacbcacf5a93844", "level": "warning", "message": {"text": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "252697060ff6233f", "scanner": "scanner-primary", "fingerprint": "afacbcacf5a93844", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pw6j-qg29-8w7f"]}}, {"ruleId": "scanner-7682be8a112b7843", "level": "note", "message": {"text": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "03b18302c1d080f1", "scanner": "scanner-primary", "fingerprint": "7682be8a112b7843", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49854"]}}, {"ruleId": "scanner-f2f945968f98fb1e", "level": "error", "message": {"text": "CVE-2026-4372: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "cd8a2d183981b38b", "scanner": "scanner-primary", "fingerprint": "f2f945968f98fb1e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4372"]}}, {"ruleId": "scanner-c07b15790e48b907", "level": "error", "message": {"text": "CVE-2026-5241: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "6af007873d65ac85", "scanner": "scanner-primary", "fingerprint": "c07b15790e48b907", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-5241"]}}, {"ruleId": "scanner-7e4fd6ad9ea1c983", "level": "error", "message": {"text": "CVE-2026-9856: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "9d5b1efd0683194f", "scanner": "scanner-primary", "fingerprint": "7e4fd6ad9ea1c983", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9856"]}}, {"ruleId": "scanner-8c854e481772871c", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.57.1 \u2014 futureagi/ee/requirements.txt"}, "properties": {"repobilityId": "39cd467e66b0b018", "scanner": "scanner-primary", "fingerprint": "8c854e481772871c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-0abc72491e6191db", "level": "warning", "message": {"text": "CVE-2024-56201: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "3e600acbb5f4e7bf", "scanner": "scanner-primary", "fingerprint": "0abc72491e6191db", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-56201"]}}, {"ruleId": "scanner-6b2b5506ee3cd3df", "level": "warning", "message": {"text": "CVE-2024-56326: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "707ad4fc58dc4038", "scanner": "scanner-primary", "fingerprint": "6b2b5506ee3cd3df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-56326"]}}, {"ruleId": "scanner-2e03e26b3869e24b", "level": "warning", "message": {"text": "CVE-2025-27516: Jinja2 3.1.4 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "3952d4087c40465d", "scanner": "scanner-primary", "fingerprint": "2e03e26b3869e24b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27516"]}}, {"ruleId": "scanner-e119cdbb7511b856", "level": "warning", "message": {"text": "CVE-2025-68146: filelock 3.15.4 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "872eec4760e1806b", "scanner": "scanner-primary", "fingerprint": "e119cdbb7511b856", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68146"]}}, {"ruleId": "scanner-2d89300de6578df4", "level": "warning", "message": {"text": "CVE-2026-22701: filelock 3.15.4 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "fbe6b476c94a5d1f", "scanner": "scanner-primary", "fingerprint": "2d89300de6578df4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22701"]}}, {"ruleId": "scanner-ce1940c364468e61", "level": "error", "message": {"text": "CVE-2024-1135: gunicorn 21.2.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "164e525b58e429de", "scanner": "scanner-primary", "fingerprint": "ce1940c364468e61", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-1135"]}}, {"ruleId": "scanner-e101b1218658b57b", "level": "error", "message": {"text": "CVE-2024-6827: gunicorn 21.2.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "f356ad99b50903b0", "scanner": "scanner-primary", "fingerprint": "e101b1218658b57b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-6827"]}}, {"ruleId": "scanner-6ed9866290529c7a", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.8 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "0a3e3ce3861a8b5f", "scanner": "scanner-primary", "fingerprint": "6ed9866290529c7a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-dd9b95fc7138c2b7", "level": "error", "message": {"text": "CVE-2026-25990: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "d3cb402c6516caa8", "scanner": "scanner-primary", "fingerprint": "dd9b95fc7138c2b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25990"]}}, {"ruleId": "scanner-dd26b22d34f7ecba", "level": "error", "message": {"text": "CVE-2026-40192: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "843f1cc7d40cfe92", "scanner": "scanner-primary", "fingerprint": "dd26b22d34f7ecba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40192"]}}, {"ruleId": "scanner-bf7722d873960973", "level": "error", "message": {"text": "CVE-2026-42311: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "6c33f4144dc0c6da", "scanner": "scanner-primary", "fingerprint": "bf7722d873960973", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42311"]}}, {"ruleId": "scanner-5c499982dedb94dc", "level": "error", "message": {"text": "CVE-2026-54058: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "b31514048e090045", "scanner": "scanner-primary", "fingerprint": "5c499982dedb94dc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54058"]}}, {"ruleId": "scanner-a67c85d67ca57fd9", "level": "error", "message": {"text": "CVE-2026-54059: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "87859f41d375718f", "scanner": "scanner-primary", "fingerprint": "a67c85d67ca57fd9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54059"]}}, {"ruleId": "scanner-3294fa4ea4dd6888", "level": "error", "message": {"text": "CVE-2026-54060: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "a2543bb8480d812b", "scanner": "scanner-primary", "fingerprint": "3294fa4ea4dd6888", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54060"]}}, {"ruleId": "scanner-4e0d61efdbffcf15", "level": "error", "message": {"text": "CVE-2026-55379: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "ac8fceb93e0aaa63", "scanner": "scanner-primary", "fingerprint": "4e0d61efdbffcf15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55379"]}}, {"ruleId": "scanner-3e1f31d0e9bacfcb", "level": "error", "message": {"text": "CVE-2026-55380: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "67b82b93e0e2f30c", "scanner": "scanner-primary", "fingerprint": "3e1f31d0e9bacfcb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55380"]}}, {"ruleId": "scanner-a68dd50c6189d0e3", "level": "error", "message": {"text": "CVE-2026-59197: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "c93d4864ca5c8895", "scanner": "scanner-primary", "fingerprint": "a68dd50c6189d0e3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59197"]}}, {"ruleId": "scanner-47cf2774ed636c0a", "level": "error", "message": {"text": "CVE-2026-59199: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "b0fe5f8a75b7392f", "scanner": "scanner-primary", "fingerprint": "47cf2774ed636c0a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59199"]}}, {"ruleId": "scanner-76d5056aa692d7ee", "level": "error", "message": {"text": "CVE-2026-59200: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "679e254af74da9b6", "scanner": "scanner-primary", "fingerprint": "76d5056aa692d7ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59200"]}}, {"ruleId": "scanner-ea11d4c1d3206ba9", "level": "error", "message": {"text": "CVE-2026-59204: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "386ec2479332f2bd", "scanner": "scanner-primary", "fingerprint": "ea11d4c1d3206ba9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59204"]}}, {"ruleId": "scanner-6fd415671af1ae98", "level": "error", "message": {"text": "CVE-2026-59205: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "6fd457780b370bee", "scanner": "scanner-primary", "fingerprint": "6fd415671af1ae98", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59205"]}}, {"ruleId": "scanner-27e9b44173cdc7ca", "level": "warning", "message": {"text": "CVE-2026-42308: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "3ce427fd52811040", "scanner": "scanner-primary", "fingerprint": "27e9b44173cdc7ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42308"]}}, {"ruleId": "scanner-30aa63b634d53065", "level": "warning", "message": {"text": "CVE-2026-42310: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "6838b6d88d5d88a7", "scanner": "scanner-primary", "fingerprint": "30aa63b634d53065", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42310"]}}, {"ruleId": "scanner-7e8286345f688dbc", "level": "warning", "message": {"text": "CVE-2026-55798: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "542b8baf5a6edb1e", "scanner": "scanner-primary", "fingerprint": "7e8286345f688dbc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55798"]}}, {"ruleId": "scanner-eb70a4c581553996", "level": "warning", "message": {"text": "CVE-2026-59198: pillow 10.4.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "b410637a665f27d5", "scanner": "scanner-primary", "fingerprint": "eb70a4c581553996", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59198"]}}, {"ruleId": "scanner-b200ea1771643139", "level": "warning", "message": {"text": "CVE-2026-28684: python-dotenv 1.0.1 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "52345dcdc9e34319", "scanner": "scanner-primary", "fingerprint": "b200ea1771643139", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28684"]}}, {"ruleId": "scanner-05d4aff77880e958", "level": "warning", "message": {"text": "CVE-2024-47081: requests 2.32.3 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "f01459093cc63d89", "scanner": "scanner-primary", "fingerprint": "05d4aff77880e958", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47081"]}}, {"ruleId": "scanner-f573292fddcef0e2", "level": "warning", "message": {"text": "CVE-2026-25645: requests 2.32.3 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "83d51968baa4c4ff", "scanner": "scanner-primary", "fingerprint": "f573292fddcef0e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25645"]}}, {"ruleId": "scanner-f3e706ae496b321a", "level": "error", "message": {"text": "CVE-2025-62727: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "3b770bc3acd94fcc", "scanner": "scanner-primary", "fingerprint": "f3e706ae496b321a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62727"]}}, {"ruleId": "scanner-ec17101f3a252f40", "level": "error", "message": {"text": "CVE-2026-48818: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "82b01ff0bc38564f", "scanner": "scanner-primary", "fingerprint": "ec17101f3a252f40", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48818"]}}, {"ruleId": "scanner-dea9cfde836c65b7", "level": "error", "message": {"text": "CVE-2026-54283: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "d9c56d06c4ec975b", "scanner": "scanner-primary", "fingerprint": "dea9cfde836c65b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54283"]}}, {"ruleId": "scanner-7b6ecfb6129c730c", "level": "warning", "message": {"text": "CVE-2025-54121: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "8628bb098e8b89cf", "scanner": "scanner-primary", "fingerprint": "7b6ecfb6129c730c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-54121"]}}, {"ruleId": "scanner-5b85947a88793d1c", "level": "warning", "message": {"text": "CVE-2026-48710: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "4ebc5a75b02dfda7", "scanner": "scanner-primary", "fingerprint": "5b85947a88793d1c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48710"]}}, {"ruleId": "scanner-80f70973b8f9bb93", "level": "warning", "message": {"text": "CVE-2026-48817: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "e50656256ef9eeb3", "scanner": "scanner-primary", "fingerprint": "80f70973b8f9bb93", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48817"]}}, {"ruleId": "scanner-0da9c133322a0b88", "level": "note", "message": {"text": "CVE-2026-54282: starlette 0.46.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "b9f1bc9d6c2bc903", "scanner": "scanner-primary", "fingerprint": "0da9c133322a0b88", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54282"]}}, {"ruleId": "scanner-71efbf79691f7288", "level": "warning", "message": {"text": "CVE-2025-2998: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "ed0a2401d848d9fa", "scanner": "scanner-primary", "fingerprint": "71efbf79691f7288", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2998"]}}, {"ruleId": "scanner-56cc3a6f618b4ea3", "level": "warning", "message": {"text": "CVE-2025-2999: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "0b0c1916fc344e92", "scanner": "scanner-primary", "fingerprint": "56cc3a6f618b4ea3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2999"]}}, {"ruleId": "scanner-8bd0075916a81a2a", "level": "warning", "message": {"text": "CVE-2025-3730: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "1f6e7949bef9733d", "scanner": "scanner-primary", "fingerprint": "8bd0075916a81a2a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3730"]}}, {"ruleId": "scanner-116075301bf939a1", "level": "note", "message": {"text": "CVE-2025-2148: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "b12081ada7af103c", "scanner": "scanner-primary", "fingerprint": "116075301bf939a1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2148"]}}, {"ruleId": "scanner-b90a0d2360244f8c", "level": "note", "message": {"text": "CVE-2025-2149: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "4e8409c6b006cf42", "scanner": "scanner-primary", "fingerprint": "b90a0d2360244f8c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2149"]}}, {"ruleId": "scanner-b86ec1d6bd95a0b1", "level": "note", "message": {"text": "CVE-2025-2953: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "b9bcc160da3503d6", "scanner": "scanner-primary", "fingerprint": "b86ec1d6bd95a0b1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2953"]}}, {"ruleId": "scanner-cde514b8f0de928d", "level": "note", "message": {"text": "CVE-2025-3000: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "4711c4535004fd59", "scanner": "scanner-primary", "fingerprint": "cde514b8f0de928d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3000"]}}, {"ruleId": "scanner-0fe9dffb8d4f514b", "level": "note", "message": {"text": "CVE-2025-3001: torch 2.6.0 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "5b219b8473472631", "scanner": "scanner-primary", "fingerprint": "0fe9dffb8d4f514b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3001"]}}, {"ruleId": "scanner-4d92f975e6863b69", "level": "error", "message": {"text": "CVE-2024-11392: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "f9669fd940caac68", "scanner": "scanner-primary", "fingerprint": "4d92f975e6863b69", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-11392"]}}, {"ruleId": "scanner-248b5a60283c417b", "level": "error", "message": {"text": "CVE-2024-11393: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "868f2cee7feae91b", "scanner": "scanner-primary", "fingerprint": "248b5a60283c417b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-11393"]}}, {"ruleId": "scanner-ab7f70275eae5498", "level": "error", "message": {"text": "CVE-2024-11394: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "88eae2bed35c014f", "scanner": "scanner-primary", "fingerprint": "ab7f70275eae5498", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-11394"]}}, {"ruleId": "scanner-5d0b8a7fcb06ea67", "level": "error", "message": {"text": "CVE-2026-4372: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "2be91626e6762356", "scanner": "scanner-primary", "fingerprint": "5d0b8a7fcb06ea67", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4372"]}}, {"ruleId": "scanner-bedd36bd0645c04f", "level": "error", "message": {"text": "CVE-2026-5241: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "e04e6edf93b27358", "scanner": "scanner-primary", "fingerprint": "bedd36bd0645c04f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-5241"]}}, {"ruleId": "scanner-86c4f81eb3b15a66", "level": "error", "message": {"text": "CVE-2026-9856: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "96d58763b649c23e", "scanner": "scanner-primary", "fingerprint": "86c4f81eb3b15a66", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9856"]}}, {"ruleId": "scanner-673571a194423c52", "level": "warning", "message": {"text": "CVE-2024-12720: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "f39cdf70c0f57655", "scanner": "scanner-primary", "fingerprint": "673571a194423c52", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-12720"]}}, {"ruleId": "scanner-0ec519529d7c092f", "level": "warning", "message": {"text": "CVE-2025-1194: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "3cffb834c6973bb2", "scanner": "scanner-primary", "fingerprint": "0ec519529d7c092f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-1194"]}}, {"ruleId": "scanner-0ebef67d379eeb6e", "level": "warning", "message": {"text": "CVE-2025-2099: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "e3abd5730f5e968d", "scanner": "scanner-primary", "fingerprint": "0ebef67d379eeb6e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2099"]}}, {"ruleId": "scanner-d5034b12b58423eb", "level": "warning", "message": {"text": "CVE-2025-3263: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "28eeb59dc79b9325", "scanner": "scanner-primary", "fingerprint": "d5034b12b58423eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3263"]}}, {"ruleId": "scanner-9aa134a4368af37f", "level": "warning", "message": {"text": "CVE-2025-3264: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "3ab61d7bc6bca87e", "scanner": "scanner-primary", "fingerprint": "9aa134a4368af37f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3264"]}}, {"ruleId": "scanner-1c94ddf4332c2015", "level": "warning", "message": {"text": "CVE-2025-3933: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "0dd84ec749efd528", "scanner": "scanner-primary", "fingerprint": "1c94ddf4332c2015", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3933"]}}, {"ruleId": "scanner-ac4ee37b7541161c", "level": "warning", "message": {"text": "CVE-2025-5197: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "27aa796b6600880e", "scanner": "scanner-primary", "fingerprint": "ac4ee37b7541161c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5197"]}}, {"ruleId": "scanner-697a4b8c802b95b1", "level": "warning", "message": {"text": "CVE-2025-6051: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "a97d243aa9171e64", "scanner": "scanner-primary", "fingerprint": "697a4b8c802b95b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6051"]}}, {"ruleId": "scanner-29d13eaf10ea6ec5", "level": "warning", "message": {"text": "CVE-2025-6638: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "c611cceb2172e227", "scanner": "scanner-primary", "fingerprint": "29d13eaf10ea6ec5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6638"]}}, {"ruleId": "scanner-775dc0fdb09116f6", "level": "warning", "message": {"text": "CVE-2025-6921: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "4897e6f1a4a817ab", "scanner": "scanner-primary", "fingerprint": "775dc0fdb09116f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6921"]}}, {"ruleId": "scanner-aa7fb2c50de4bb68", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "fba121bfc96f6897", "scanner": "scanner-primary", "fingerprint": "aa7fb2c50de4bb68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-12f9ebeb85d41bf1", "level": "note", "message": {"text": "CVE-2025-3777: transformers 4.44.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "d4adb4b8aa1ab42e", "scanner": "scanner-primary", "fingerprint": "12f9ebeb85d41bf1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3777"]}}, {"ruleId": "scanner-63ee0d2734a70441", "level": "error", "message": {"text": "CVE-2025-66418: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "789a20f1df1e6523", "scanner": "scanner-primary", "fingerprint": "63ee0d2734a70441", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66418"]}}, {"ruleId": "scanner-cb26aa2ecd857fd9", "level": "error", "message": {"text": "CVE-2025-66471: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "e5128dc7d1cb566a", "scanner": "scanner-primary", "fingerprint": "cb26aa2ecd857fd9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66471"]}}, {"ruleId": "scanner-6f627cb46371ed85", "level": "error", "message": {"text": "CVE-2026-21441: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "cdb6a50644f9a339", "scanner": "scanner-primary", "fingerprint": "6f627cb46371ed85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-21441"]}}, {"ruleId": "scanner-c732f4f1dee6773c", "level": "error", "message": {"text": "CVE-2026-44431: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "31feb7ae4386722c", "scanner": "scanner-primary", "fingerprint": "c732f4f1dee6773c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44431"]}}, {"ruleId": "scanner-bcd7b9762720593d", "level": "warning", "message": {"text": "CVE-2025-50181: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "7b57b4e7c49a41e0", "scanner": "scanner-primary", "fingerprint": "bcd7b9762720593d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-50181"]}}, {"ruleId": "scanner-666ab2aa759d3a5a", "level": "warning", "message": {"text": "CVE-2025-50182: urllib3 2.2.2 \u2014 futureagi/model_serving/requirements.txt"}, "properties": {"repobilityId": "d2489506ad6929a5", "scanner": "scanner-primary", "fingerprint": "666ab2aa759d3a5a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-50182"]}}, {"ruleId": "scanner-5a544610e829f936", "level": "error", "message": {"text": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "94eb5712a7c99052", "scanner": "scanner-primary", "fingerprint": "5a544610e829f936", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26209"]}}, {"ruleId": "scanner-e1654bdf26c3e7d5", "level": "error", "message": {"text": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "14efcbed21fe0e89", "scanner": "scanner-primary", "fingerprint": "e1654bdf26c3e7d5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69247"]}}, {"ruleId": "scanner-c1122e9d5931f249", "level": "error", "message": {"text": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "059dadfc199ea7a2", "scanner": "scanner-primary", "fingerprint": "c1122e9d5931f249", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69249"]}}, {"ruleId": "scanner-dc29dd14a73294cf", "level": "error", "message": {"text": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "210d45dfa08cb90c", "scanner": "scanner-primary", "fingerprint": "dc29dd14a73294cf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-537c-gmf6-5ccf"]}}, {"ruleId": "scanner-20aa2d3ebb169689", "level": "warning", "message": {"text": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6c4040359a979bc8", "scanner": "scanner-primary", "fingerprint": "20aa2d3ebb169689", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39892"]}}, {"ruleId": "scanner-6d439de858be4d82", "level": "warning", "message": {"text": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2e076a9c2395f618", "scanner": "scanner-primary", "fingerprint": "6d439de858be4d82", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69248"]}}, {"ruleId": "scanner-d62c8828c5ca36de", "level": "note", "message": {"text": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "725783b30f71bb65", "scanner": "scanner-primary", "fingerprint": "d62c8828c5ca36de", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34073"]}}, {"ruleId": "scanner-e8fd1a5a52cbb08a", "level": "error", "message": {"text": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "010f2b90d3a7def9", "scanner": "scanner-primary", "fingerprint": "e8fd1a5a52cbb08a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64459"]}}, {"ruleId": "scanner-45ce999d99a995a3", "level": "error", "message": {"text": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ee978d88ce658ba4", "scanner": "scanner-primary", "fingerprint": "45ce999d99a995a3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57833"]}}, {"ruleId": "scanner-ae2bbff7ca48ec18", "level": "error", "message": {"text": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "85ad847b86a69014", "scanner": "scanner-primary", "fingerprint": "ae2bbff7ca48ec18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59681"]}}, {"ruleId": "scanner-942c618c1d5d48be", "level": "error", "message": {"text": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "fbb6167e8f6761dd", "scanner": "scanner-primary", "fingerprint": "942c618c1d5d48be", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64458"]}}, {"ruleId": "scanner-3e700d6c90a358ed", "level": "warning", "message": {"text": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d5eb03f56042c311", "scanner": "scanner-primary", "fingerprint": "3e700d6c90a358ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13372"]}}, {"ruleId": "scanner-4b76df8114f15fec", "level": "warning", "message": {"text": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "c9b78a5ffa2673d4", "scanner": "scanner-primary", "fingerprint": "4b76df8114f15fec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-32873"]}}, {"ruleId": "scanner-068e2e6cb1860ad7", "level": "warning", "message": {"text": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "332d9d84062a39a4", "scanner": "scanner-primary", "fingerprint": "068e2e6cb1860ad7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-48432"]}}, {"ruleId": "scanner-cf768f2ee1b25f73", "level": "warning", "message": {"text": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "11341686f085800b", "scanner": "scanner-primary", "fingerprint": "cf768f2ee1b25f73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64460"]}}, {"ruleId": "scanner-3e593734ce7c6ec0", "level": "warning", "message": {"text": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d3823bc82107a2c5", "scanner": "scanner-primary", "fingerprint": "3e593734ce7c6ec0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53877"]}}, {"ruleId": "scanner-001de6d1be120c3c", "level": "warning", "message": {"text": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ca1e0c2d2042040d", "scanner": "scanner-primary", "fingerprint": "001de6d1be120c3c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53878"]}}, {"ruleId": "scanner-64b2ba55fd837b04", "level": "note", "message": {"text": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "deb382b8991545c7", "scanner": "scanner-primary", "fingerprint": "64b2ba55fd837b04", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59682"]}}, {"ruleId": "scanner-4799c346e168b087", "level": "note", "message": {"text": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cbde1666ce056a69", "scanner": "scanner-primary", "fingerprint": "4799c346e168b087", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48587"]}}, {"ruleId": "scanner-bc984dded6cc1150", "level": "note", "message": {"text": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cfad71f7fc4ccbbc", "scanner": "scanner-primary", "fingerprint": "bc984dded6cc1150", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48588"]}}, {"ruleId": "scanner-8524f7dc024aec28", "level": "note", "message": {"text": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3b12f0f61bda25b2", "scanner": "scanner-primary", "fingerprint": "8524f7dc024aec28", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6873"]}}, {"ruleId": "scanner-a9237d8df081d482", "level": "note", "message": {"text": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "e0aae1f4b459b95f", "scanner": "scanner-primary", "fingerprint": "a9237d8df081d482", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8404"]}}, {"ruleId": "scanner-24ce905cee1788ed", "level": "warning", "message": {"text": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6dc08652ab127d95", "scanner": "scanner-primary", "fingerprint": "24ce905cee1788ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73228"]}}, {"ruleId": "scanner-976b575c07e0de4e", "level": "warning", "message": {"text": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "55904244e09c4a23", "scanner": "scanner-primary", "fingerprint": "976b575c07e0de4e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73229"]}}, {"ruleId": "scanner-91f018bc6ea87add", "level": "error", "message": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5d2754aa0f427da6", "scanner": "scanner-primary", "fingerprint": "91f018bc6ea87add", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-23342"]}}, {"ruleId": "scanner-248df155b2174e0e", "level": "warning", "message": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "b3b9e9fd9b6333d9", "scanner": "scanner-primary", "fingerprint": "248df155b2174e0e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33936"]}}, {"ruleId": "scanner-1ed2baf70bfc94fa", "level": "error", "message": {"text": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "28c6f7332ca1ed0c", "scanner": "scanner-primary", "fingerprint": "1ed2baf70bfc94fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42544"]}}, {"ruleId": "scanner-c2b98cefcb59a1ea", "level": "warning", "message": {"text": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "7ab797f507b25966", "scanner": "scanner-primary", "fingerprint": "c2b98cefcb59a1ea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42545"]}}, {"ruleId": "scanner-ecc628b54bf798cb", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5ee37ed619306c66", "scanner": "scanner-primary", "fingerprint": "ecc628b54bf798cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-31e040e00bf344f0", "level": "error", "message": {"text": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6c7ca952ac6a7c56", "scanner": "scanner-primary", "fingerprint": "31e040e00bf344f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xf7x-x43h-rpqh"]}}, {"ruleId": "scanner-e80b2c0c7999e4ac", "level": "error", "message": {"text": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "78d5b292e3b03cde", "scanner": "scanner-primary", "fingerprint": "e80b2c0c7999e4ac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-f26871b4243f2e1b", "level": "warning", "message": {"text": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "c1abb5b680930120", "scanner": "scanner-primary", "fingerprint": "f26871b4243f2e1b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55443"]}}, {"ruleId": "scanner-21dbbea630d5d7b5", "level": "error", "message": {"text": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "390b87ae51f48fca", "scanner": "scanner-primary", "fingerprint": "21dbbea630d5d7b5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34070"]}}, {"ruleId": "scanner-aa557ee26a768096", "level": "error", "message": {"text": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cfc9f7b0333574cc", "scanner": "scanner-primary", "fingerprint": "aa557ee26a768096", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44843"]}}, {"ruleId": "scanner-a9589a23c9efb308", "level": "warning", "message": {"text": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f2784024bcbbbf0a", "scanner": "scanner-primary", "fingerprint": "a9589a23c9efb308", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40087"]}}, {"ruleId": "scanner-3b10755e15351bdd", "level": "note", "message": {"text": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "73d4bf9a4a4146af", "scanner": "scanner-primary", "fingerprint": "3b10755e15351bdd", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26013"]}}, {"ruleId": "scanner-90ccd4eb36e1d171", "level": "warning", "message": {"text": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "204a7284104c54d9", "scanner": "scanner-primary", "fingerprint": "90ccd4eb36e1d171", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41481"]}}, {"ruleId": "scanner-117458447f33e5c2", "level": "error", "message": {"text": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "8992d2e168dc56fe", "scanner": "scanner-primary", "fingerprint": "117458447f33e5c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-48bce0196dbf6e27", "level": "error", "message": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4e0918f7614f3917", "scanner": "scanner-primary", "fingerprint": "48bce0196dbf6e27", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f4xh-w4cj-qxq8"]}}, {"ruleId": "scanner-a90c20864fd34c62", "level": "warning", "message": {"text": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5792814ea83d0a87", "scanner": "scanner-primary", "fingerprint": "a90c20864fd34c62", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41182"]}}, {"ruleId": "scanner-790d97e2475b9adf", "level": "error", "message": {"text": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "82fbbc8cf8d5e881", "scanner": "scanner-primary", "fingerprint": "790d97e2475b9adf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35030"]}}, {"ruleId": "scanner-b44321ea2a54d601", "level": "error", "message": {"text": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2bea43d8648d3a79", "scanner": "scanner-primary", "fingerprint": "b44321ea2a54d601", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-37004"]}}, {"ruleId": "scanner-65549636a7d47d90", "level": "error", "message": {"text": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a6339a7dbef5f059", "scanner": "scanner-primary", "fingerprint": "65549636a7d47d90", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49468"]}}, {"ruleId": "scanner-c82672891327aaf3", "level": "error", "message": {"text": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "c7215bb6d5bcffad", "scanner": "scanner-primary", "fingerprint": "c82672891327aaf3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35029"]}}, {"ruleId": "scanner-2b5249c5dbc54285", "level": "error", "message": {"text": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "65746a5bb7fa2d38", "scanner": "scanner-primary", "fingerprint": "2b5249c5dbc54285", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40217"]}}, {"ruleId": "scanner-4cd1968eb075863e", "level": "error", "message": {"text": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d5e5ef931680f9e6", "scanner": "scanner-primary", "fingerprint": "4cd1968eb075863e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42203"]}}, {"ruleId": "scanner-204dad75ee837f07", "level": "error", "message": {"text": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "380f3ab4d70230b0", "scanner": "scanner-primary", "fingerprint": "204dad75ee837f07", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42271"]}}, {"ruleId": "scanner-f5f2bbc3f83a39c2", "level": "error", "message": {"text": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1aab8abfa973f7ba", "scanner": "scanner-primary", "fingerprint": "f5f2bbc3f83a39c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47101"]}}, {"ruleId": "scanner-33a88142cfd20548", "level": "error", "message": {"text": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "0427f3b1429ddbad", "scanner": "scanner-primary", "fingerprint": "33a88142cfd20548", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47102"]}}, {"ruleId": "scanner-59979defd8023e7f", "level": "error", "message": {"text": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3b178cad34c06ed7", "scanner": "scanner-primary", "fingerprint": "59979defd8023e7f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59822"]}}, {"ruleId": "scanner-099c96d8e39da89c", "level": "error", "message": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "00e1fe7c8de7fdfc", "scanner": "scanner-primary", "fingerprint": "099c96d8e39da89c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-69x8-hrgq-fjj8"]}}, {"ruleId": "scanner-00a9076b9c9810e6", "level": "warning", "message": {"text": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "731fbc57230bb6dc", "scanner": "scanner-primary", "fingerprint": "00a9076b9c9810e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12773"]}}, {"ruleId": "scanner-9875d1e02e5d670f", "level": "warning", "message": {"text": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1da300579800eaab", "scanner": "scanner-primary", "fingerprint": "9875d1e02e5d670f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12795"]}}, {"ruleId": "scanner-338f961c7d4e0cc6", "level": "warning", "message": {"text": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "822be1a1275c9815", "scanner": "scanner-primary", "fingerprint": "338f961c7d4e0cc6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59820"]}}, {"ruleId": "scanner-0b3553beb01cc4df", "level": "warning", "message": {"text": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ca591d39854cb1d5", "scanner": "scanner-primary", "fingerprint": "0b3553beb01cc4df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59823"]}}, {"ruleId": "scanner-e5cbba8cc2b29f46", "level": "note", "message": {"text": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ca47c53e57e88509", "scanner": "scanner-primary", "fingerprint": "e5cbba8cc2b29f46", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12771"]}}, {"ruleId": "scanner-262bbf9debc34df7", "level": "note", "message": {"text": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ba86c96e22d6dfcb", "scanner": "scanner-primary", "fingerprint": "262bbf9debc34df7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12772"]}}, {"ruleId": "scanner-4216c4a721cd99d8", "level": "note", "message": {"text": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d236091269fc9937", "scanner": "scanner-primary", "fingerprint": "4216c4a721cd99d8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12796"]}}, {"ruleId": "scanner-94bde684cbac0578", "level": "note", "message": {"text": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f47aba8ab3a3227f", "scanner": "scanner-primary", "fingerprint": "94bde684cbac0578", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12797"]}}, {"ruleId": "scanner-bb392625e00df4d6", "level": "note", "message": {"text": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "7fca36bca6fd7c3a", "scanner": "scanner-primary", "fingerprint": "bb392625e00df4d6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12798"]}}, {"ruleId": "scanner-10c2f48a6b531351", "level": "note", "message": {"text": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6545122364d9e834", "scanner": "scanner-primary", "fingerprint": "10c2f48a6b531351", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12799"]}}, {"ruleId": "scanner-1161a63922e41e3a", "level": "note", "message": {"text": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "9c83f856d5a0467b", "scanner": "scanner-primary", "fingerprint": "1161a63922e41e3a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59819"]}}, {"ruleId": "scanner-fc8ea53787bb9f8a", "level": "note", "message": {"text": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4633ea47f3985cd4", "scanner": "scanner-primary", "fingerprint": "fc8ea53787bb9f8a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59821"]}}, {"ruleId": "scanner-332e67b09162a09c", "level": "error", "message": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cef9b1269ba030cc", "scanner": "scanner-primary", "fingerprint": "332e67b09162a09c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41066"]}}, {"ruleId": "scanner-c94b0177a42a36b5", "level": "error", "message": {"text": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2a6238c3a8b5ee8d", "scanner": "scanner-primary", "fingerprint": "c94b0177a42a36b5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-52869"]}}, {"ruleId": "scanner-2999d1e5c8db7620", "level": "error", "message": {"text": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6b7fc1cb60a1cb3b", "scanner": "scanner-primary", "fingerprint": "2999d1e5c8db7620", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-52870"]}}, {"ruleId": "scanner-f4a6fa6ec5e27ade", "level": "error", "message": {"text": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "497b0d640f5ab680", "scanner": "scanner-primary", "fingerprint": "f4a6fa6ec5e27ade", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59950"]}}, {"ruleId": "scanner-9ad99d0be32f4592", "level": "error", "message": {"text": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1272c0e129ee0277", "scanner": "scanner-primary", "fingerprint": "9ad99d0be32f4592", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-6v7p-g79w-8964"]}}, {"ruleId": "scanner-6e0ab967aeca5d57", "level": "error", "message": {"text": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1aea7fac1090eea0", "scanner": "scanner-primary", "fingerprint": "6e0ab967aeca5d57", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-14009"]}}, {"ruleId": "scanner-32c674579221f01c", "level": "error", "message": {"text": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "75c4f1554f56d1e4", "scanner": "scanner-primary", "fingerprint": "32c674579221f01c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78683"]}}, {"ruleId": "scanner-7d5cb84adb99db3f", "level": "error", "message": {"text": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "dcf31aaa2d98e4b0", "scanner": "scanner-primary", "fingerprint": "7d5cb84adb99db3f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79657"]}}, {"ruleId": "scanner-24a66271cd03504d", "level": "error", "message": {"text": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "af1601dddfba1d15", "scanner": "scanner-primary", "fingerprint": "24a66271cd03504d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79675"]}}, {"ruleId": "scanner-26bd172a43e3a735", "level": "error", "message": {"text": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "44a9043c68a490bb", "scanner": "scanner-primary", "fingerprint": "26bd172a43e3a735", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71408"]}}, {"ruleId": "scanner-701b448db4815b01", "level": "error", "message": {"text": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "319b9a7b2396ce41", "scanner": "scanner-primary", "fingerprint": "701b448db4815b01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0846"]}}, {"ruleId": "scanner-555473065ff6c07c", "level": "error", "message": {"text": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "eb10d17ba23b7c37", "scanner": "scanner-primary", "fingerprint": "555473065ff6c07c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0847"]}}, {"ruleId": "scanner-e3ff4b75c7caebbc", "level": "error", "message": {"text": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "de399487ed9d13c3", "scanner": "scanner-primary", "fingerprint": "e3ff4b75c7caebbc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12061"]}}, {"ruleId": "scanner-714624b83a1a6d77", "level": "error", "message": {"text": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "717d68fe810f7b7a", "scanner": "scanner-primary", "fingerprint": "714624b83a1a6d77", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12072"]}}, {"ruleId": "scanner-51d4d01045ed866a", "level": "error", "message": {"text": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a91fe078d7dd79ab", "scanner": "scanner-primary", "fingerprint": "51d4d01045ed866a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12074"]}}, {"ruleId": "scanner-5f2d911ae837e3ff", "level": "error", "message": {"text": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5692a7ea213e4c6e", "scanner": "scanner-primary", "fingerprint": "5f2d911ae837e3ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12075"]}}, {"ruleId": "scanner-4e8728889e4e5540", "level": "error", "message": {"text": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a344cc3ceb2a585c", "scanner": "scanner-primary", "fingerprint": "4e8728889e4e5540", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33231"]}}, {"ruleId": "scanner-1b3a2807d9dcb603", "level": "error", "message": {"text": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "489f44fc17c65794", "scanner": "scanner-primary", "fingerprint": "1b3a2807d9dcb603", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33236"]}}, {"ruleId": "scanner-aa5d55ec611f0461", "level": "error", "message": {"text": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "c45b5167184575c3", "scanner": "scanner-primary", "fingerprint": "aa5d55ec611f0461", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54293"]}}, {"ruleId": "scanner-c283eb84d28d6ac5", "level": "error", "message": {"text": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "746b110919514d3a", "scanner": "scanner-primary", "fingerprint": "c283eb84d28d6ac5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-62385"]}}, {"ruleId": "scanner-a950b269cd6053a0", "level": "error", "message": {"text": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "13dfa5eb1d25c3ef", "scanner": "scanner-primary", "fingerprint": "a950b269cd6053a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-62388"]}}, {"ruleId": "scanner-47f86ab20687353c", "level": "error", "message": {"text": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "bc7174a45b6fae72", "scanner": "scanner-primary", "fingerprint": "47f86ab20687353c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-63312"]}}, {"ruleId": "scanner-52e7b02d12d8823e", "level": "error", "message": {"text": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "752b767467a11935", "scanner": "scanner-primary", "fingerprint": "52e7b02d12d8823e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-70626"]}}, {"ruleId": "scanner-6bebdeb0b227b61a", "level": "error", "message": {"text": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "9a958c42b04d542e", "scanner": "scanner-primary", "fingerprint": "6bebdeb0b227b61a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-72818"]}}, {"ruleId": "scanner-d4acd89d8a3b3dac", "level": "error", "message": {"text": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "780de748dbce7545", "scanner": "scanner-primary", "fingerprint": "d4acd89d8a3b3dac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78680"]}}, {"ruleId": "scanner-548d7aa9e0835e32", "level": "error", "message": {"text": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "0bdea8bd50c02909", "scanner": "scanner-primary", "fingerprint": "548d7aa9e0835e32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78681"]}}, {"ruleId": "scanner-c2ea59dc411cdb7a", "level": "error", "message": {"text": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6bc3fb562216accf", "scanner": "scanner-primary", "fingerprint": "c2ea59dc411cdb7a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78682"]}}, {"ruleId": "scanner-8ee6204224c6a639", "level": "error", "message": {"text": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3c25194f06a00872", "scanner": "scanner-primary", "fingerprint": "8ee6204224c6a639", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79674"]}}, {"ruleId": "scanner-fea23603fe45ce8e", "level": "error", "message": {"text": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ccdacf88ef2eb1f9", "scanner": "scanner-primary", "fingerprint": "fea23603fe45ce8e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79676"]}}, {"ruleId": "scanner-c0649f1f5d766e66", "level": "error", "message": {"text": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "987c06e3e7296f42", "scanner": "scanner-primary", "fingerprint": "c0649f1f5d766e66", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-80205"]}}, {"ruleId": "scanner-5e399efdb9a0aa76", "level": "error", "message": {"text": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "8cd869e8d049c309", "scanner": "scanner-primary", "fingerprint": "5e399efdb9a0aa76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-80206"]}}, {"ruleId": "scanner-c138062bc7b73df6", "level": "error", "message": {"text": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "456057327e6023f1", "scanner": "scanner-primary", "fingerprint": "c138062bc7b73df6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81726"]}}, {"ruleId": "scanner-ff97983f4553422e", "level": "warning", "message": {"text": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2106a59029c54096", "scanner": "scanner-primary", "fingerprint": "ff97983f4553422e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12259"]}}, {"ruleId": "scanner-ba5dfa9f6cbe885f", "level": "warning", "message": {"text": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a5e4940793255d55", "scanner": "scanner-primary", "fingerprint": "ba5dfa9f6cbe885f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12876"]}}, {"ruleId": "scanner-f38620aa51c77a89", "level": "warning", "message": {"text": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "e2c385a757ebe02f", "scanner": "scanner-primary", "fingerprint": "f38620aa51c77a89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33230"]}}, {"ruleId": "scanner-4d2df0c57c78a8dc", "level": "warning", "message": {"text": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d49522ce77c257af", "scanner": "scanner-primary", "fingerprint": "4d2df0c57c78a8dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-63311"]}}, {"ruleId": "scanner-57e87c4d07c3749d", "level": "warning", "message": {"text": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "70eb24afa1c3948d", "scanner": "scanner-primary", "fingerprint": "57e87c4d07c3749d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65915"]}}, {"ruleId": "scanner-c66d64acc6030833", "level": "warning", "message": {"text": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3c416d4912c8d66f", "scanner": "scanner-primary", "fingerprint": "c66d64acc6030833", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-66393"]}}, {"ruleId": "scanner-10e2d04667ea7a99", "level": "warning", "message": {"text": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "0293d6a1b6f4170d", "scanner": "scanner-primary", "fingerprint": "10e2d04667ea7a99", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81722"]}}, {"ruleId": "scanner-66eb3ebb32514156", "level": "warning", "message": {"text": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f65ad6396e4bd0d8", "scanner": "scanner-primary", "fingerprint": "66eb3ebb32514156", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81723"]}}, {"ruleId": "scanner-70979e81cf3fd145", "level": "warning", "message": {"text": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4b61e931bf36a05f", "scanner": "scanner-primary", "fingerprint": "70979e81cf3fd145", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81724"]}}, {"ruleId": "scanner-895b62b6bb4c57e8", "level": "warning", "message": {"text": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f9791db564e8fe79", "scanner": "scanner-primary", "fingerprint": "895b62b6bb4c57e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81725"]}}, {"ruleId": "scanner-2a7e0a749fc73582", "level": "warning", "message": {"text": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2b67e7ca7fe67c1a", "scanner": "scanner-primary", "fingerprint": "2a7e0a749fc73582", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81727"]}}, {"ruleId": "scanner-58d0601410b12520", "level": "error", "message": {"text": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3e4b4a9bd9fcbb52", "scanner": "scanner-primary", "fingerprint": "58d0601410b12520", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-67221"]}}, {"ruleId": "scanner-5e52c5722e628e74", "level": "error", "message": {"text": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "024383c815f78fb0", "scanner": "scanner-primary", "fingerprint": "5e52c5722e628e74", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25990"]}}, {"ruleId": "scanner-32fab04dde93f6d7", "level": "error", "message": {"text": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "554b638e822651e2", "scanner": "scanner-primary", "fingerprint": "32fab04dde93f6d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40192"]}}, {"ruleId": "scanner-dc519e99770cf07d", "level": "error", "message": {"text": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "de185b13779fefb3", "scanner": "scanner-primary", "fingerprint": "dc519e99770cf07d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42311"]}}, {"ruleId": "scanner-e837ce83bd8f955f", "level": "error", "message": {"text": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d25875ff82a3729c", "scanner": "scanner-primary", "fingerprint": "e837ce83bd8f955f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54058"]}}, {"ruleId": "scanner-1b52ba916f9d67d2", "level": "error", "message": {"text": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f84d6b8061e3e931", "scanner": "scanner-primary", "fingerprint": "1b52ba916f9d67d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54059"]}}, {"ruleId": "scanner-2bb4c003148caecf", "level": "error", "message": {"text": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6e5f0265efa583b6", "scanner": "scanner-primary", "fingerprint": "2bb4c003148caecf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54060"]}}, {"ruleId": "scanner-7693dea7dc801052", "level": "error", "message": {"text": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "db2a09ac132aad96", "scanner": "scanner-primary", "fingerprint": "7693dea7dc801052", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55379"]}}, {"ruleId": "scanner-92a35f9a6f76525b", "level": "error", "message": {"text": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6529692646449416", "scanner": "scanner-primary", "fingerprint": "92a35f9a6f76525b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55380"]}}, {"ruleId": "scanner-480b4cd0d60eb2d4", "level": "error", "message": {"text": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1b1205174da3bcac", "scanner": "scanner-primary", "fingerprint": "480b4cd0d60eb2d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59197"]}}, {"ruleId": "scanner-e4ed2faeb3e1cb74", "level": "error", "message": {"text": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2f773461639875c7", "scanner": "scanner-primary", "fingerprint": "e4ed2faeb3e1cb74", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59199"]}}, {"ruleId": "scanner-537004c4db1d4a42", "level": "error", "message": {"text": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a1c37946aa69a8e2", "scanner": "scanner-primary", "fingerprint": "537004c4db1d4a42", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59200"]}}, {"ruleId": "scanner-61c2535dae39d209", "level": "error", "message": {"text": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "72c8ef54d26048f3", "scanner": "scanner-primary", "fingerprint": "61c2535dae39d209", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59204"]}}, {"ruleId": "scanner-b53792b820cc7621", "level": "error", "message": {"text": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "13dbe27fff433c6a", "scanner": "scanner-primary", "fingerprint": "b53792b820cc7621", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59205"]}}, {"ruleId": "scanner-151dd397cd023e96", "level": "warning", "message": {"text": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "b42934537fe55247", "scanner": "scanner-primary", "fingerprint": "151dd397cd023e96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42308"]}}, {"ruleId": "scanner-684e688fd4ba19bd", "level": "warning", "message": {"text": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cc372daa157778a2", "scanner": "scanner-primary", "fingerprint": "684e688fd4ba19bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42309"]}}, {"ruleId": "scanner-77887b127c9f4680", "level": "warning", "message": {"text": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "aa10fde693fc8217", "scanner": "scanner-primary", "fingerprint": "77887b127c9f4680", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42310"]}}, {"ruleId": "scanner-d55440bb2e2ef9ca", "level": "warning", "message": {"text": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ffe6ec023f749571", "scanner": "scanner-primary", "fingerprint": "d55440bb2e2ef9ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55798"]}}, {"ruleId": "scanner-879f245bd848e06b", "level": "warning", "message": {"text": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "bd315a317b0dcd20", "scanner": "scanner-primary", "fingerprint": "879f245bd848e06b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59198"]}}, {"ruleId": "scanner-5f51b289204e1947", "level": "warning", "message": {"text": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ccd29e12143b47ac", "scanner": "scanner-primary", "fingerprint": "5f51b289204e1947", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59203"]}}, {"ruleId": "scanner-cb5eec094feca9e5", "level": "error", "message": {"text": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1d9c37accc2226ea", "scanner": "scanner-primary", "fingerprint": "cb5eec094feca9e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23490"]}}, {"ruleId": "scanner-6688f61ebeed2245", "level": "error", "message": {"text": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a813597b4b66dadc", "scanner": "scanner-primary", "fingerprint": "6688f61ebeed2245", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-30922"]}}, {"ruleId": "scanner-43ebcf2331d5ef08", "level": "error", "message": {"text": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "01ddb4957fec93ab", "scanner": "scanner-primary", "fingerprint": "43ebcf2331d5ef08", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59884"]}}, {"ruleId": "scanner-90fbc11cceb4c7d7", "level": "error", "message": {"text": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "99c199beaa41c22a", "scanner": "scanner-primary", "fingerprint": "90fbc11cceb4c7d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59885"]}}, {"ruleId": "scanner-3e47712236c41437", "level": "error", "message": {"text": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "de301da247565777", "scanner": "scanner-primary", "fingerprint": "3e47712236c41437", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59886"]}}, {"ruleId": "scanner-504a7fcbaca77db9", "level": "warning", "message": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "294c3a6a31bab9e9", "scanner": "scanner-primary", "fingerprint": "504a7fcbaca77db9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4xgf-cpjx-pc3j"]}}, {"ruleId": "scanner-464591ef0a8dc149", "level": "error", "message": {"text": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "0c47d953dbf56c96", "scanner": "scanner-primary", "fingerprint": "464591ef0a8dc149", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-32597"]}}, {"ruleId": "scanner-5f87b1e6d26e0d02", "level": "error", "message": {"text": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "58356f7c7010fb8c", "scanner": "scanner-primary", "fingerprint": "5f87b1e6d26e0d02", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48526"]}}, {"ruleId": "scanner-9fea73d949915f76", "level": "warning", "message": {"text": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cc87b5289c233a77", "scanner": "scanner-primary", "fingerprint": "9fea73d949915f76", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48522"]}}, {"ruleId": "scanner-92f436c7a6595637", "level": "warning", "message": {"text": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6708a03643617792", "scanner": "scanner-primary", "fingerprint": "92f436c7a6595637", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48523"]}}, {"ruleId": "scanner-4f745deb4a5e3131", "level": "warning", "message": {"text": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "585717d027710ebc", "scanner": "scanner-primary", "fingerprint": "4f745deb4a5e3131", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48525"]}}, {"ruleId": "scanner-89eecfc99051a0d3", "level": "note", "message": {"text": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "e655a48f6570a6c2", "scanner": "scanner-primary", "fingerprint": "89eecfc99051a0d3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48524"]}}, {"ruleId": "scanner-d2ecbd7b61ef4347", "level": "error", "message": {"text": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "24896f2ebb128b21", "scanner": "scanner-primary", "fingerprint": "d2ecbd7b61ef4347", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59935"]}}, {"ruleId": "scanner-958af2e6bd361b65", "level": "error", "message": {"text": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5c84649367f7c512", "scanner": "scanner-primary", "fingerprint": "958af2e6bd361b65", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59936"]}}, {"ruleId": "scanner-c99a5aa32fd2fec2", "level": "warning", "message": {"text": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "cd283f83b8396646", "scanner": "scanner-primary", "fingerprint": "c99a5aa32fd2fec2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24688"]}}, {"ruleId": "scanner-eb34b674c4ef0c94", "level": "warning", "message": {"text": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d1041c5ab33505e6", "scanner": "scanner-primary", "fingerprint": "eb34b674c4ef0c94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27024"]}}, {"ruleId": "scanner-3caa1b0374b616f8", "level": "warning", "message": {"text": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "b353de6b25d2efa3", "scanner": "scanner-primary", "fingerprint": "3caa1b0374b616f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27025"]}}, {"ruleId": "scanner-05b1311f66ecd478", "level": "warning", "message": {"text": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4e73f9a9cf00e83e", "scanner": "scanner-primary", "fingerprint": "05b1311f66ecd478", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27026"]}}, {"ruleId": "scanner-396b3bba80f674e5", "level": "warning", "message": {"text": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "06917841784964a2", "scanner": "scanner-primary", "fingerprint": "396b3bba80f674e5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27888"]}}, {"ruleId": "scanner-4e45c77ca581a0e4", "level": "warning", "message": {"text": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d472691f7ddd7618", "scanner": "scanner-primary", "fingerprint": "4e45c77ca581a0e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28351"]}}, {"ruleId": "scanner-ae8cadb67e0f674c", "level": "warning", "message": {"text": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "7eee88bfe811cd8a", "scanner": "scanner-primary", "fingerprint": "ae8cadb67e0f674c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28804"]}}, {"ruleId": "scanner-8c251924ccfb7055", "level": "warning", "message": {"text": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "9088f4fa5e5503e8", "scanner": "scanner-primary", "fingerprint": "8c251924ccfb7055", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31826"]}}, {"ruleId": "scanner-c62c4b2dfce5faee", "level": "warning", "message": {"text": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6c0426f31bcffa35", "scanner": "scanner-primary", "fingerprint": "c62c4b2dfce5faee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33123"]}}, {"ruleId": "scanner-605387da7dc2b8c2", "level": "warning", "message": {"text": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "b77e09ee68e7444b", "scanner": "scanner-primary", "fingerprint": "605387da7dc2b8c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33699"]}}, {"ruleId": "scanner-fea2300a71496a30", "level": "warning", "message": {"text": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1cf66dcaf1ff800d", "scanner": "scanner-primary", "fingerprint": "fea2300a71496a30", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40260"]}}, {"ruleId": "scanner-984d992f3a6a60d8", "level": "warning", "message": {"text": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d3fdc771a12ab759", "scanner": "scanner-primary", "fingerprint": "984d992f3a6a60d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41168"]}}, {"ruleId": "scanner-41df8a4b6b52f485", "level": "warning", "message": {"text": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "fa48fe0a0570779c", "scanner": "scanner-primary", "fingerprint": "41df8a4b6b52f485", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41312"]}}, {"ruleId": "scanner-68eeb0583870c5fb", "level": "warning", "message": {"text": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "de034f6af03b7173", "scanner": "scanner-primary", "fingerprint": "68eeb0583870c5fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41313"]}}, {"ruleId": "scanner-190aeace19cedc03", "level": "warning", "message": {"text": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "63678be2fd700ca8", "scanner": "scanner-primary", "fingerprint": "190aeace19cedc03", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41314"]}}, {"ruleId": "scanner-c6f31611c9a57e7d", "level": "warning", "message": {"text": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "653ef581dbcda89e", "scanner": "scanner-primary", "fingerprint": "c6f31611c9a57e7d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48155"]}}, {"ruleId": "scanner-54820e4f7db2c810", "level": "warning", "message": {"text": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d0aaebc040e80913", "scanner": "scanner-primary", "fingerprint": "54820e4f7db2c810", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48156"]}}, {"ruleId": "scanner-252de2ed4c1da062", "level": "warning", "message": {"text": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "adec0dc17a5c5e1d", "scanner": "scanner-primary", "fingerprint": "252de2ed4c1da062", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48735"]}}, {"ruleId": "scanner-e9528fb066d64ba8", "level": "warning", "message": {"text": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "026c7b987f3dab73", "scanner": "scanner-primary", "fingerprint": "e9528fb066d64ba8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49460"]}}, {"ruleId": "scanner-8475394eed76070d", "level": "warning", "message": {"text": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "d732ab2fae1ee208", "scanner": "scanner-primary", "fingerprint": "8475394eed76070d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49461"]}}, {"ruleId": "scanner-64306316d0efdaf5", "level": "warning", "message": {"text": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "39e2c63045787b55", "scanner": "scanner-primary", "fingerprint": "64306316d0efdaf5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54530"]}}, {"ruleId": "scanner-578fe2be8f3dd6b0", "level": "warning", "message": {"text": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "508f3b2d648224c8", "scanner": "scanner-primary", "fingerprint": "578fe2be8f3dd6b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54531"]}}, {"ruleId": "scanner-1f844a1986bb0047", "level": "warning", "message": {"text": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "eab74850140c812c", "scanner": "scanner-primary", "fingerprint": "1f844a1986bb0047", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54651"]}}, {"ruleId": "scanner-f27e959d2fa0b5ac", "level": "warning", "message": {"text": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3ec5346174d4a6e1", "scanner": "scanner-primary", "fingerprint": "f27e959d2fa0b5ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59937"]}}, {"ruleId": "scanner-9919873076418da1", "level": "warning", "message": {"text": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "306cd8d0909d001a", "scanner": "scanner-primary", "fingerprint": "9919873076418da1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59938"]}}, {"ruleId": "scanner-f044f254f642169b", "level": "warning", "message": {"text": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a12f5b050eea4e71", "scanner": "scanner-primary", "fingerprint": "f044f254f642169b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71852"]}}, {"ruleId": "scanner-16442659192af62c", "level": "warning", "message": {"text": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "235f7dc6bafe6838", "scanner": "scanner-primary", "fingerprint": "16442659192af62c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71870"]}}, {"ruleId": "scanner-1b4a21a2a817f16b", "level": "warning", "message": {"text": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "e1950165cfb82ecd", "scanner": "scanner-primary", "fingerprint": "1b4a21a2a817f16b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82398"]}}, {"ruleId": "scanner-8045f51c8ba0d4a0", "level": "warning", "message": {"text": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "9b200ef9a53173b5", "scanner": "scanner-primary", "fingerprint": "8045f51c8ba0d4a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84309"]}}, {"ruleId": "scanner-95c08d25f365f241", "level": "warning", "message": {"text": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2577e3d9969f9aa0", "scanner": "scanner-primary", "fingerprint": "95c08d25f365f241", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84310"]}}, {"ruleId": "scanner-12691c54e183f870", "level": "warning", "message": {"text": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "473a2c3be1111146", "scanner": "scanner-primary", "fingerprint": "12691c54e183f870", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84311"]}}, {"ruleId": "scanner-c24dbf2af1b3be46", "level": "warning", "message": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f6edd16020d5c93a", "scanner": "scanner-primary", "fingerprint": "c24dbf2af1b3be46", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jm82-fx9c-mx94"]}}, {"ruleId": "scanner-70e11d0f02500fe4", "level": "note", "message": {"text": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5a9285cd61c0d5a2", "scanner": "scanner-primary", "fingerprint": "70e11d0f02500fe4", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27628"]}}, {"ruleId": "scanner-251f754d66f2c1ec", "level": "warning", "message": {"text": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3cd78f7e47436b18", "scanner": "scanner-primary", "fingerprint": "251f754d66f2c1ec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28684"]}}, {"ruleId": "scanner-c26f9387f688fedd", "level": "warning", "message": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6c0ef5cd37949933", "scanner": "scanner-primary", "fingerprint": "c26f9387f688fedd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25645"]}}, {"ruleId": "scanner-3cc393f47c3ab88c", "level": "warning", "message": {"text": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "0f3e39d2fe02f936", "scanner": "scanner-primary", "fingerprint": "3cc393f47c3ab88c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59890"]}}, {"ruleId": "scanner-db2a3d237243648f", "level": "error", "message": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "a0e4498857054647", "scanner": "scanner-primary", "fingerprint": "db2a3d237243648f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49476"]}}, {"ruleId": "scanner-67ea6c97d8a22004", "level": "error", "message": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "1265259e4605fea5", "scanner": "scanner-primary", "fingerprint": "67ea6c97d8a22004", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49477"]}}, {"ruleId": "scanner-1955bd7ffad93702", "level": "warning", "message": {"text": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "0d18d73c01d0abcf", "scanner": "scanner-primary", "fingerprint": "1955bd7ffad93702", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-85999"]}}, {"ruleId": "scanner-923d9ac424068f44", "level": "warning", "message": {"text": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "ea262e4560841ced", "scanner": "scanner-primary", "fingerprint": "923d9ac424068f44", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-86000"]}}, {"ruleId": "scanner-59bcc30541ceb06e", "level": "error", "message": {"text": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "72acfb3849395be4", "scanner": "scanner-primary", "fingerprint": "59bcc30541ceb06e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54284"]}}, {"ruleId": "scanner-ee69750139f5f7dc", "level": "error", "message": {"text": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3bcf17f5d19f3eb4", "scanner": "scanner-primary", "fingerprint": "ee69750139f5f7dc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59893"]}}, {"ruleId": "scanner-f77ae8755dd917fb", "level": "error", "message": {"text": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3b768d7144e584d4", "scanner": "scanner-primary", "fingerprint": "f77ae8755dd917fb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71491"]}}, {"ruleId": "scanner-13a5f0128e2fb7c3", "level": "warning", "message": {"text": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "6a850206d55d110f", "scanner": "scanner-primary", "fingerprint": "13a5f0128e2fb7c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59894"]}}, {"ruleId": "scanner-64b509f826dc8dae", "level": "warning", "message": {"text": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3831e4b7ca2c4b58", "scanner": "scanner-primary", "fingerprint": "64b509f826dc8dae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84305"]}}, {"ruleId": "scanner-8ec1d29439923900", "level": "error", "message": {"text": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "2fdf3a24470bcb5b", "scanner": "scanner-primary", "fingerprint": "8ec1d29439923900", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48818"]}}, {"ruleId": "scanner-da9b653b6e26e627", "level": "error", "message": {"text": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "3ceeac044c3bdae8", "scanner": "scanner-primary", "fingerprint": "da9b653b6e26e627", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54283"]}}, {"ruleId": "scanner-c199bd44e3522f40", "level": "warning", "message": {"text": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "e2a2822776ef65c6", "scanner": "scanner-primary", "fingerprint": "c199bd44e3522f40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48710"]}}, {"ruleId": "scanner-c7d1c9fbe4a89849", "level": "warning", "message": {"text": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "698289d17086b730", "scanner": "scanner-primary", "fingerprint": "c7d1c9fbe4a89849", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48817"]}}, {"ruleId": "scanner-699be9582b3bbe40", "level": "note", "message": {"text": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4dccde30c149c2df", "scanner": "scanner-primary", "fingerprint": "699be9582b3bbe40", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54282"]}}, {"ruleId": "scanner-1ce8f7ef73944bf0", "level": "error", "message": {"text": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "32f51bb35b1bcdd0", "scanner": "scanner-primary", "fingerprint": "1ce8f7ef73944bf0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31958"]}}, {"ruleId": "scanner-4b1b0ae5aa24cc97", "level": "error", "message": {"text": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "099446d25e6d2e0b", "scanner": "scanner-primary", "fingerprint": "4b1b0ae5aa24cc97", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35536"]}}, {"ruleId": "scanner-b6ef6fca9515db3f", "level": "error", "message": {"text": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "5022db854f4d52d1", "scanner": "scanner-primary", "fingerprint": "b6ef6fca9515db3f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49853"]}}, {"ruleId": "scanner-9870fb6f0d79c968", "level": "error", "message": {"text": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "acc1b27655393e3b", "scanner": "scanner-primary", "fingerprint": "9870fb6f0d79c968", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49855"]}}, {"ruleId": "scanner-b1e94ff29d2447da", "level": "error", "message": {"text": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "f6824eb1c6f43da8", "scanner": "scanner-primary", "fingerprint": "b1e94ff29d2447da", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82397"]}}, {"ruleId": "scanner-c3fc23b9107f1b26", "level": "warning", "message": {"text": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "63e28973c558a0f4", "scanner": "scanner-primary", "fingerprint": "c3fc23b9107f1b26", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-78cv-mqj4-43f7"]}}, {"ruleId": "scanner-95bf7d7a69ea2350", "level": "warning", "message": {"text": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "e1a5131b6cec9bdd", "scanner": "scanner-primary", "fingerprint": "95bf7d7a69ea2350", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8423-8fgw-73vq"]}}, {"ruleId": "scanner-f28a95807fe151f1", "level": "warning", "message": {"text": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4dbf97a812a41e0f", "scanner": "scanner-primary", "fingerprint": "f28a95807fe151f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pw6j-qg29-8w7f"]}}, {"ruleId": "scanner-0c0ce244d87625bf", "level": "note", "message": {"text": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/requirements.txt"}, "properties": {"repobilityId": "4ab935ae705bb623", "scanner": "scanner-primary", "fingerprint": "0c0ce244d87625bf", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49854"]}}, {"ruleId": "scanner-7c53b258d49e5dd2", "level": "error", "message": {"text": "CVE-2026-27962: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9040a74fceec6075", "scanner": "scanner-primary", "fingerprint": "7c53b258d49e5dd2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27962"]}}, {"ruleId": "scanner-6be4a52a9c504c24", "level": "error", "message": {"text": "CVE-2026-28490: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "445cc7fdad232528", "scanner": "scanner-primary", "fingerprint": "6be4a52a9c504c24", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28490"]}}, {"ruleId": "scanner-ab341f05017d9525", "level": "error", "message": {"text": "CVE-2026-28498: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "a0f8f9f651f967b3", "scanner": "scanner-primary", "fingerprint": "ab341f05017d9525", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28498"]}}, {"ruleId": "scanner-994ca034952f8da1", "level": "error", "message": {"text": "CVE-2026-28802: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e774734fb3c72684", "scanner": "scanner-primary", "fingerprint": "994ca034952f8da1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28802"]}}, {"ruleId": "scanner-98196d338c8ae110", "level": "warning", "message": {"text": "CVE-2026-41425: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0530a444a186f902", "scanner": "scanner-primary", "fingerprint": "98196d338c8ae110", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41425"]}}, {"ruleId": "scanner-ae9388ee9d1a21e6", "level": "warning", "message": {"text": "CVE-2026-41479: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9d112d27cb647880", "scanner": "scanner-primary", "fingerprint": "ae9388ee9d1a21e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41479"]}}, {"ruleId": "scanner-1aeba9ae06c02437", "level": "warning", "message": {"text": "CVE-2026-44681: authlib 1.6.6 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3a270aa062b5436d", "scanner": "scanner-primary", "fingerprint": "1aeba9ae06c02437", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44681"]}}, {"ruleId": "scanner-6668af700ce13d83", "level": "error", "message": {"text": "CVE-2026-26209: cbor2 5.8.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "436e36a102fe5a25", "scanner": "scanner-primary", "fingerprint": "6668af700ce13d83", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26209"]}}, {"ruleId": "scanner-9d5c4374b9f87de3", "level": "error", "message": {"text": "CVE-2026-45829: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b9d133acfed7183e", "scanner": "scanner-primary", "fingerprint": "9d5c4374b9f87de3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45829"]}}, {"ruleId": "scanner-d003c450437d52dd", "level": "error", "message": {"text": "CVE-2026-45833: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "bc5f053d800d3d74", "scanner": "scanner-primary", "fingerprint": "d003c450437d52dd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45833"]}}, {"ruleId": "scanner-8a4ebebfb1e46721", "level": "error", "message": {"text": "CVE-2026-45830: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "fcba17fb5eff5c5c", "scanner": "scanner-primary", "fingerprint": "8a4ebebfb1e46721", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45830"]}}, {"ruleId": "scanner-0f2ff9b5e4ec8721", "level": "error", "message": {"text": "CVE-2026-45831: chromadb 1.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b79831c649f72fa2", "scanner": "scanner-primary", "fingerprint": "0f2ff9b5e4ec8721", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45831"]}}, {"ruleId": "scanner-afdfafeb4c9c9e6d", "level": "error", "message": {"text": "CVE-2026-69247: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "500b8f9159446068", "scanner": "scanner-primary", "fingerprint": "afdfafeb4c9c9e6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69247"]}}, {"ruleId": "scanner-1d8e9034f987c2a7", "level": "error", "message": {"text": "CVE-2026-69249: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "24682c9dcbf6bbf3", "scanner": "scanner-primary", "fingerprint": "1d8e9034f987c2a7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69249"]}}, {"ruleId": "scanner-6f09551586f16d2c", "level": "error", "message": {"text": "GHSA-537c-gmf6-5ccf: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "424df384ef0f69e1", "scanner": "scanner-primary", "fingerprint": "6f09551586f16d2c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-537c-gmf6-5ccf"]}}, {"ruleId": "scanner-2dc186b9145206e2", "level": "warning", "message": {"text": "CVE-2026-39892: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "251ae24e084547ad", "scanner": "scanner-primary", "fingerprint": "2dc186b9145206e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39892"]}}, {"ruleId": "scanner-5af6e4abca548f32", "level": "warning", "message": {"text": "CVE-2026-69248: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c4bb4c233a46f3ca", "scanner": "scanner-primary", "fingerprint": "5af6e4abca548f32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69248"]}}, {"ruleId": "scanner-0e5579ada0a9e94e", "level": "note", "message": {"text": "CVE-2026-34073: cryptography 46.0.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2eb3275a4abae868", "scanner": "scanner-primary", "fingerprint": "0e5579ada0a9e94e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34073"]}}, {"ruleId": "scanner-0ff9b39bb05969d2", "level": "error", "message": {"text": "CVE-2025-64459: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "239a3eb61ed11c24", "scanner": "scanner-primary", "fingerprint": "0ff9b39bb05969d2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64459"]}}, {"ruleId": "scanner-03333e35017fe82b", "level": "error", "message": {"text": "CVE-2025-57833: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "235e0ba2944afc1a", "scanner": "scanner-primary", "fingerprint": "03333e35017fe82b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57833"]}}, {"ruleId": "scanner-e30a74a7b3eb5b82", "level": "error", "message": {"text": "CVE-2025-59681: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b8c7b9e5242e0fc6", "scanner": "scanner-primary", "fingerprint": "e30a74a7b3eb5b82", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59681"]}}, {"ruleId": "scanner-7002463a20ecc8aa", "level": "error", "message": {"text": "CVE-2025-64458: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "6954abe67ef010e0", "scanner": "scanner-primary", "fingerprint": "7002463a20ecc8aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64458"]}}, {"ruleId": "scanner-4a7a3fde2b93cc34", "level": "warning", "message": {"text": "CVE-2025-13372: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9b456b4db3a76dd4", "scanner": "scanner-primary", "fingerprint": "4a7a3fde2b93cc34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13372"]}}, {"ruleId": "scanner-6381bdb8577f8bd5", "level": "warning", "message": {"text": "CVE-2025-32873: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2ccac0c3701d17e3", "scanner": "scanner-primary", "fingerprint": "6381bdb8577f8bd5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-32873"]}}, {"ruleId": "scanner-4fa82eb8a57fc4b1", "level": "warning", "message": {"text": "CVE-2025-48432: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "92869f4690c8f85a", "scanner": "scanner-primary", "fingerprint": "4fa82eb8a57fc4b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-48432"]}}, {"ruleId": "scanner-ed26e781227554c5", "level": "warning", "message": {"text": "CVE-2025-64460: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c661c19e750b43ef", "scanner": "scanner-primary", "fingerprint": "ed26e781227554c5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-64460"]}}, {"ruleId": "scanner-b66f8edad3772f59", "level": "warning", "message": {"text": "CVE-2026-53877: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "fd712641be456fb3", "scanner": "scanner-primary", "fingerprint": "b66f8edad3772f59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53877"]}}, {"ruleId": "scanner-819fa5668879a7c8", "level": "warning", "message": {"text": "CVE-2026-53878: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "45278fcf4ab4c52b", "scanner": "scanner-primary", "fingerprint": "819fa5668879a7c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53878"]}}, {"ruleId": "scanner-3796f996759df316", "level": "note", "message": {"text": "CVE-2025-59682: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "cc42df3b7a974068", "scanner": "scanner-primary", "fingerprint": "3796f996759df316", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59682"]}}, {"ruleId": "scanner-e5cad7e48763e6a7", "level": "note", "message": {"text": "CVE-2026-48587: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "485847208f227d49", "scanner": "scanner-primary", "fingerprint": "e5cad7e48763e6a7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48587"]}}, {"ruleId": "scanner-c44ab91ad40efc01", "level": "note", "message": {"text": "CVE-2026-48588: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5056ec1ce62a5834", "scanner": "scanner-primary", "fingerprint": "c44ab91ad40efc01", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48588"]}}, {"ruleId": "scanner-ee3d2985a3d083d3", "level": "note", "message": {"text": "CVE-2026-6873: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0a9c0533fd87db8c", "scanner": "scanner-primary", "fingerprint": "ee3d2985a3d083d3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6873"]}}, {"ruleId": "scanner-b0979ef0d974d971", "level": "note", "message": {"text": "CVE-2026-8404: django 5.1.8 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2489d345848c7152", "scanner": "scanner-primary", "fingerprint": "b0979ef0d974d971", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8404"]}}, {"ruleId": "scanner-604f297fd3bb0488", "level": "warning", "message": {"text": "CVE-2026-73228: djangorestframework 3.16.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "502216a16af3f71d", "scanner": "scanner-primary", "fingerprint": "604f297fd3bb0488", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73228"]}}, {"ruleId": "scanner-74514e6b2e5d87a7", "level": "warning", "message": {"text": "CVE-2026-73229: djangorestframework 3.16.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e582d7d2a189dccd", "scanner": "scanner-primary", "fingerprint": "74514e6b2e5d87a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73229"]}}, {"ruleId": "scanner-24dd58884d75965f", "level": "error", "message": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "55989637ed50e4cc", "scanner": "scanner-primary", "fingerprint": "24dd58884d75965f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-23342"]}}, {"ruleId": "scanner-6f8debfa35bcc1b3", "level": "warning", "message": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b60e499f7f6ac6ee", "scanner": "scanner-primary", "fingerprint": "6f8debfa35bcc1b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33936"]}}, {"ruleId": "scanner-27ae8df3e6401230", "level": "error", "message": {"text": "CVE-2026-42544: granian 2.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "57f9f624a0a8cb62", "scanner": "scanner-primary", "fingerprint": "27ae8df3e6401230", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42544"]}}, {"ruleId": "scanner-7412d416149ac05b", "level": "warning", "message": {"text": "CVE-2026-42545: granian 2.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2b0e24f75f2cd1c8", "scanner": "scanner-primary", "fingerprint": "7412d416149ac05b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42545"]}}, {"ruleId": "scanner-f84b8da172ccd8eb", "level": "warning", "message": {"text": "CVE-2026-71554: h2 4.3.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f46f381894dbe5a0", "scanner": "scanner-primary", "fingerprint": "f84b8da172ccd8eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71554"]}}, {"ruleId": "scanner-ee992fac32822ca5", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "61744455be28f8f2", "scanner": "scanner-primary", "fingerprint": "ee992fac32822ca5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-720dbd3cb1fe0832", "level": "error", "message": {"text": "GHSA-xf7x-x43h-rpqh: json-repair 0.55.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "aef4d3997eb0b3d7", "scanner": "scanner-primary", "fingerprint": "720dbd3cb1fe0832", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xf7x-x43h-rpqh"]}}, {"ruleId": "scanner-724ba484cc310a76", "level": "error", "message": {"text": "CVE-2026-45134: langchain 0.3.27 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "80b60c92fd2784d1", "scanner": "scanner-primary", "fingerprint": "724ba484cc310a76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-bc6e8fc579b78174", "level": "warning", "message": {"text": "CVE-2026-55443: langchain 0.3.27 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d0de67f90d8583ce", "scanner": "scanner-primary", "fingerprint": "bc6e8fc579b78174", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55443"]}}, {"ruleId": "scanner-f3ac1b9310f074f6", "level": "error", "message": {"text": "CVE-2026-34070: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "11b1388579ca4e3b", "scanner": "scanner-primary", "fingerprint": "f3ac1b9310f074f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34070"]}}, {"ruleId": "scanner-a1ea9d36cecd24f5", "level": "error", "message": {"text": "CVE-2026-44843: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1ba7c20f1c046cd3", "scanner": "scanner-primary", "fingerprint": "a1ea9d36cecd24f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44843"]}}, {"ruleId": "scanner-3c5a0cd6f29bb0a9", "level": "warning", "message": {"text": "CVE-2026-40087: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "54d6d4ef4162f724", "scanner": "scanner-primary", "fingerprint": "3c5a0cd6f29bb0a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40087"]}}, {"ruleId": "scanner-317a8e6a6d0cccce", "level": "note", "message": {"text": "CVE-2026-26013: langchain-core 0.3.83 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "399f8cf27da9aa42", "scanner": "scanner-primary", "fingerprint": "317a8e6a6d0cccce", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26013"]}}, {"ruleId": "scanner-d87733f1caa227cd", "level": "warning", "message": {"text": "CVE-2026-41481: langchain-text-splitters 0.3.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3119a29ea310da77", "scanner": "scanner-primary", "fingerprint": "d87733f1caa227cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41481"]}}, {"ruleId": "scanner-949d09aac21934a9", "level": "error", "message": {"text": "CVE-2026-45134: langsmith 0.6.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f149e98696b20c56", "scanner": "scanner-primary", "fingerprint": "949d09aac21934a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-c9adfbdffa1c8417", "level": "error", "message": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.6.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "30e85903ab08e65f", "scanner": "scanner-primary", "fingerprint": "c9adfbdffa1c8417", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f4xh-w4cj-qxq8"]}}, {"ruleId": "scanner-0c60a5b1967c9768", "level": "warning", "message": {"text": "CVE-2026-41182: langsmith 0.6.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "abad76b5914a2545", "scanner": "scanner-primary", "fingerprint": "0c60a5b1967c9768", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41182"]}}, {"ruleId": "scanner-25e32907f7969e75", "level": "error", "message": {"text": "CVE-2026-35030: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5b62071629d5a672", "scanner": "scanner-primary", "fingerprint": "25e32907f7969e75", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35030"]}}, {"ruleId": "scanner-135478de55e96561", "level": "error", "message": {"text": "CVE-2026-37004: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "32a7e4d3c6a0d69f", "scanner": "scanner-primary", "fingerprint": "135478de55e96561", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-37004"]}}, {"ruleId": "scanner-d21b7120be94d886", "level": "error", "message": {"text": "CVE-2026-49468: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "778c76ca7aaccb66", "scanner": "scanner-primary", "fingerprint": "d21b7120be94d886", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49468"]}}, {"ruleId": "scanner-e315a1b70b591a8a", "level": "error", "message": {"text": "CVE-2026-35029: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "78ed473ce3aa2f00", "scanner": "scanner-primary", "fingerprint": "e315a1b70b591a8a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35029"]}}, {"ruleId": "scanner-e4236d588d322755", "level": "error", "message": {"text": "CVE-2026-40217: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "caf63edad29a54ac", "scanner": "scanner-primary", "fingerprint": "e4236d588d322755", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40217"]}}, {"ruleId": "scanner-f6c213bc1b624945", "level": "error", "message": {"text": "CVE-2026-42203: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "ae3b7ed06bbe761e", "scanner": "scanner-primary", "fingerprint": "f6c213bc1b624945", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42203"]}}, {"ruleId": "scanner-4308ae5358aa9069", "level": "error", "message": {"text": "CVE-2026-42271: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "7b73e72a32a897c2", "scanner": "scanner-primary", "fingerprint": "4308ae5358aa9069", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42271"]}}, {"ruleId": "scanner-3f312645d5756268", "level": "error", "message": {"text": "CVE-2026-47101: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b8806d8318f1cbbd", "scanner": "scanner-primary", "fingerprint": "3f312645d5756268", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47101"]}}, {"ruleId": "scanner-ab4b6e03156b5db9", "level": "error", "message": {"text": "CVE-2026-47102: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d60533491df68d62", "scanner": "scanner-primary", "fingerprint": "ab4b6e03156b5db9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47102"]}}, {"ruleId": "scanner-271975e13c4e7689", "level": "error", "message": {"text": "CVE-2026-59822: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "8e2bd915772b966f", "scanner": "scanner-primary", "fingerprint": "271975e13c4e7689", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59822"]}}, {"ruleId": "scanner-abb262dcfc282aa6", "level": "error", "message": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0024e812b97a6c0d", "scanner": "scanner-primary", "fingerprint": "abb262dcfc282aa6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-69x8-hrgq-fjj8"]}}, {"ruleId": "scanner-845584e2b2856dea", "level": "warning", "message": {"text": "CVE-2026-12773: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e1ff5fa9cfef8323", "scanner": "scanner-primary", "fingerprint": "845584e2b2856dea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12773"]}}, {"ruleId": "scanner-3a5eb9e64f973bb5", "level": "warning", "message": {"text": "CVE-2026-12795: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "956828228b511af6", "scanner": "scanner-primary", "fingerprint": "3a5eb9e64f973bb5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12795"]}}, {"ruleId": "scanner-efd63a02d07c312d", "level": "warning", "message": {"text": "CVE-2026-59820: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3320a1570c489e68", "scanner": "scanner-primary", "fingerprint": "efd63a02d07c312d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59820"]}}, {"ruleId": "scanner-a009c3e262533581", "level": "warning", "message": {"text": "CVE-2026-59823: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1d7024f9cab7393e", "scanner": "scanner-primary", "fingerprint": "a009c3e262533581", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59823"]}}, {"ruleId": "scanner-c2816e5eb8d38ca1", "level": "note", "message": {"text": "CVE-2026-12771: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e663a89f991694cc", "scanner": "scanner-primary", "fingerprint": "c2816e5eb8d38ca1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12771"]}}, {"ruleId": "scanner-a28e0a9a77c3b2b0", "level": "note", "message": {"text": "CVE-2026-12772: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c7a34c2fb471e807", "scanner": "scanner-primary", "fingerprint": "a28e0a9a77c3b2b0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12772"]}}, {"ruleId": "scanner-62146f9094acb59c", "level": "note", "message": {"text": "CVE-2026-12796: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "ac4d812d81701ba1", "scanner": "scanner-primary", "fingerprint": "62146f9094acb59c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12796"]}}, {"ruleId": "scanner-79b58f3c651c496d", "level": "note", "message": {"text": "CVE-2026-12797: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "193fa6f0b98446fc", "scanner": "scanner-primary", "fingerprint": "79b58f3c651c496d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12797"]}}, {"ruleId": "scanner-b578046a19cf995e", "level": "note", "message": {"text": "CVE-2026-12798: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "528ed553cfd6a408", "scanner": "scanner-primary", "fingerprint": "b578046a19cf995e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12798"]}}, {"ruleId": "scanner-41d37f8401547b0f", "level": "note", "message": {"text": "CVE-2026-12799: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d7390f9de2b49718", "scanner": "scanner-primary", "fingerprint": "41d37f8401547b0f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12799"]}}, {"ruleId": "scanner-b69e2ec83e4d1ee7", "level": "note", "message": {"text": "CVE-2026-59819: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4768fff200290bed", "scanner": "scanner-primary", "fingerprint": "b69e2ec83e4d1ee7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59819"]}}, {"ruleId": "scanner-bb422cf0f3739790", "level": "note", "message": {"text": "CVE-2026-59821: litellm 1.81.11 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e0898083866eef10", "scanner": "scanner-primary", "fingerprint": "bb422cf0f3739790", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59821"]}}, {"ruleId": "scanner-954b773119deb8b7", "level": "error", "message": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "170ce7597d6d312e", "scanner": "scanner-primary", "fingerprint": "954b773119deb8b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41066"]}}, {"ruleId": "scanner-86a78b246c136bda", "level": "error", "message": {"text": "CVE-2026-41205: mako 1.3.10 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "370bc1a2881d760d", "scanner": "scanner-primary", "fingerprint": "86a78b246c136bda", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41205"]}}, {"ruleId": "scanner-83aa96b6e7e5d96a", "level": "error", "message": {"text": "CVE-2026-44307: mako 1.3.10 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1f358710036ae0bc", "scanner": "scanner-primary", "fingerprint": "83aa96b6e7e5d96a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44307"]}}, {"ruleId": "scanner-653aa43f9d6726f8", "level": "error", "message": {"text": "CVE-2026-52869: mcp 1.26.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5ae921771eb5b052", "scanner": "scanner-primary", "fingerprint": "653aa43f9d6726f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-52869"]}}, {"ruleId": "scanner-ca20c5e651d2518c", "level": "error", "message": {"text": "CVE-2026-52870: mcp 1.26.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "dacbf8389c012408", "scanner": "scanner-primary", "fingerprint": "ca20c5e651d2518c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-52870"]}}, {"ruleId": "scanner-7f75ace49dc88576", "level": "error", "message": {"text": "CVE-2026-59950: mcp 1.26.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b0abe28066d1e868", "scanner": "scanner-primary", "fingerprint": "7f75ace49dc88576", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59950"]}}, {"ruleId": "scanner-b42e47d9e7b71e24", "level": "error", "message": {"text": "GHSA-6v7p-g79w-8964: msgpack 1.1.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1e21c4bcc7cf22ba", "scanner": "scanner-primary", "fingerprint": "b42e47d9e7b71e24", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-6v7p-g79w-8964"]}}, {"ruleId": "scanner-43e883c79eac95b1", "level": "error", "message": {"text": "CVE-2025-14009: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "fdbbde9dc0637260", "scanner": "scanner-primary", "fingerprint": "43e883c79eac95b1", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-14009"]}}, {"ruleId": "scanner-448405a2e9aea74e", "level": "error", "message": {"text": "CVE-2026-78683: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b1455d0f92eb8f4a", "scanner": "scanner-primary", "fingerprint": "448405a2e9aea74e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78683"]}}, {"ruleId": "scanner-264eaa1e141a1d03", "level": "error", "message": {"text": "CVE-2026-79657: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9217eb62d04293f3", "scanner": "scanner-primary", "fingerprint": "264eaa1e141a1d03", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79657"]}}, {"ruleId": "scanner-8e96d1f768a61559", "level": "error", "message": {"text": "CVE-2026-79675: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e5bc31143f91cdfa", "scanner": "scanner-primary", "fingerprint": "8e96d1f768a61559", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79675"]}}, {"ruleId": "scanner-e2acbc37461845f6", "level": "error", "message": {"text": "CVE-2025-71408: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "97d6a869cb7d0824", "scanner": "scanner-primary", "fingerprint": "e2acbc37461845f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71408"]}}, {"ruleId": "scanner-f2cd55deaf09722c", "level": "error", "message": {"text": "CVE-2026-0846: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "cbb8ea429b885f0e", "scanner": "scanner-primary", "fingerprint": "f2cd55deaf09722c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0846"]}}, {"ruleId": "scanner-54474ce9be81a411", "level": "error", "message": {"text": "CVE-2026-0847: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d95ad57037b8b28a", "scanner": "scanner-primary", "fingerprint": "54474ce9be81a411", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0847"]}}, {"ruleId": "scanner-e5eaae7860e066c8", "level": "error", "message": {"text": "CVE-2026-12061: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5db901a95f4a7f2e", "scanner": "scanner-primary", "fingerprint": "e5eaae7860e066c8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12061"]}}, {"ruleId": "scanner-3110726031830a0b", "level": "error", "message": {"text": "CVE-2026-12072: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "22074e413d664ecf", "scanner": "scanner-primary", "fingerprint": "3110726031830a0b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12072"]}}, {"ruleId": "scanner-9d2ddcdd7fcad149", "level": "error", "message": {"text": "CVE-2026-12074: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "04aeccfc758555fd", "scanner": "scanner-primary", "fingerprint": "9d2ddcdd7fcad149", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12074"]}}, {"ruleId": "scanner-66f8df3bea13f55f", "level": "error", "message": {"text": "CVE-2026-12075: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e8d826b04acda9dd", "scanner": "scanner-primary", "fingerprint": "66f8df3bea13f55f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12075"]}}, {"ruleId": "scanner-f8f4732bb7520035", "level": "error", "message": {"text": "CVE-2026-33231: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2b8c5d89b63d74e3", "scanner": "scanner-primary", "fingerprint": "f8f4732bb7520035", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33231"]}}, {"ruleId": "scanner-90d363c7e9042b38", "level": "error", "message": {"text": "CVE-2026-33236: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "a97ef5ad3102d990", "scanner": "scanner-primary", "fingerprint": "90d363c7e9042b38", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33236"]}}, {"ruleId": "scanner-2ff6b00d2cfb911b", "level": "error", "message": {"text": "CVE-2026-54293: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "8f1b8a513a533d1f", "scanner": "scanner-primary", "fingerprint": "2ff6b00d2cfb911b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54293"]}}, {"ruleId": "scanner-216439116a80251e", "level": "error", "message": {"text": "CVE-2026-62385: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "92d9a2fffc252254", "scanner": "scanner-primary", "fingerprint": "216439116a80251e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-62385"]}}, {"ruleId": "scanner-f494e450e898e727", "level": "error", "message": {"text": "CVE-2026-62388: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "deb80d556a1efc7e", "scanner": "scanner-primary", "fingerprint": "f494e450e898e727", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-62388"]}}, {"ruleId": "scanner-828d95ac23be2b62", "level": "error", "message": {"text": "CVE-2026-63312: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9eb382899d4f69d0", "scanner": "scanner-primary", "fingerprint": "828d95ac23be2b62", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-63312"]}}, {"ruleId": "scanner-b8e30bff0a9e7ea9", "level": "error", "message": {"text": "CVE-2026-70626: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "45665fe80895e775", "scanner": "scanner-primary", "fingerprint": "b8e30bff0a9e7ea9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-70626"]}}, {"ruleId": "scanner-2ead8c183f7141a1", "level": "error", "message": {"text": "CVE-2026-72818: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5ff8c6930507b5e6", "scanner": "scanner-primary", "fingerprint": "2ead8c183f7141a1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-72818"]}}, {"ruleId": "scanner-e1a90d9cd193d013", "level": "error", "message": {"text": "CVE-2026-78680: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3e4d561ab1658901", "scanner": "scanner-primary", "fingerprint": "e1a90d9cd193d013", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78680"]}}, {"ruleId": "scanner-079c41d2a2d49cd5", "level": "error", "message": {"text": "CVE-2026-78681: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1793bc4d26710a02", "scanner": "scanner-primary", "fingerprint": "079c41d2a2d49cd5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78681"]}}, {"ruleId": "scanner-98e87bc35ac5cd13", "level": "error", "message": {"text": "CVE-2026-78682: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "bb5f8f7e41fa7d86", "scanner": "scanner-primary", "fingerprint": "98e87bc35ac5cd13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78682"]}}, {"ruleId": "scanner-a164e4a77cf3731e", "level": "error", "message": {"text": "CVE-2026-79674: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2c86cca89c3a729f", "scanner": "scanner-primary", "fingerprint": "a164e4a77cf3731e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79674"]}}, {"ruleId": "scanner-13d072adc6ef54e8", "level": "error", "message": {"text": "CVE-2026-79676: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2f5c45a90a76a8d5", "scanner": "scanner-primary", "fingerprint": "13d072adc6ef54e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-79676"]}}, {"ruleId": "scanner-fe92f6f378c7cc14", "level": "error", "message": {"text": "CVE-2026-80205: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "dbb26e5eb2af1c35", "scanner": "scanner-primary", "fingerprint": "fe92f6f378c7cc14", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-80205"]}}, {"ruleId": "scanner-4016729a1b341700", "level": "error", "message": {"text": "CVE-2026-80206: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "2a1b5e899274cd42", "scanner": "scanner-primary", "fingerprint": "4016729a1b341700", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-80206"]}}, {"ruleId": "scanner-bb9fad4ff0da97ad", "level": "error", "message": {"text": "CVE-2026-81726: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9c1dfc63d06da3d9", "scanner": "scanner-primary", "fingerprint": "bb9fad4ff0da97ad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81726"]}}, {"ruleId": "scanner-d65bed1d5164fd4e", "level": "warning", "message": {"text": "CVE-2026-12259: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "15c0caf5800fe98d", "scanner": "scanner-primary", "fingerprint": "d65bed1d5164fd4e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12259"]}}, {"ruleId": "scanner-047a77b765e14e0a", "level": "warning", "message": {"text": "CVE-2026-12876: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "090e8ce491d491c9", "scanner": "scanner-primary", "fingerprint": "047a77b765e14e0a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12876"]}}, {"ruleId": "scanner-e42c1c064216bc80", "level": "warning", "message": {"text": "CVE-2026-33230: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "900e4b75516bc632", "scanner": "scanner-primary", "fingerprint": "e42c1c064216bc80", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33230"]}}, {"ruleId": "scanner-0727f55ad1964c45", "level": "warning", "message": {"text": "CVE-2026-63311: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5d10aaa94927de85", "scanner": "scanner-primary", "fingerprint": "0727f55ad1964c45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-63311"]}}, {"ruleId": "scanner-7ce6e29e61682d32", "level": "warning", "message": {"text": "CVE-2026-65915: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "444e621b54fba2db", "scanner": "scanner-primary", "fingerprint": "7ce6e29e61682d32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65915"]}}, {"ruleId": "scanner-13e0193898b87ae7", "level": "warning", "message": {"text": "CVE-2026-66393: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "43972d939c84095b", "scanner": "scanner-primary", "fingerprint": "13e0193898b87ae7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-66393"]}}, {"ruleId": "scanner-1e754d175a0dcc32", "level": "warning", "message": {"text": "CVE-2026-81722: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "88777253c441b6b5", "scanner": "scanner-primary", "fingerprint": "1e754d175a0dcc32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81722"]}}, {"ruleId": "scanner-518bccbd332cd728", "level": "warning", "message": {"text": "CVE-2026-81723: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "943becd2a7c65b55", "scanner": "scanner-primary", "fingerprint": "518bccbd332cd728", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81723"]}}, {"ruleId": "scanner-b3cbb756b1b199b7", "level": "warning", "message": {"text": "CVE-2026-81724: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b461aea5fe14c4f5", "scanner": "scanner-primary", "fingerprint": "b3cbb756b1b199b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81724"]}}, {"ruleId": "scanner-7193afba45a3d204", "level": "warning", "message": {"text": "CVE-2026-81725: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "94d09659d3bd48b6", "scanner": "scanner-primary", "fingerprint": "7193afba45a3d204", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81725"]}}, {"ruleId": "scanner-3720b43a8da078ba", "level": "warning", "message": {"text": "CVE-2026-81727: nltk 3.9.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4a4d5dd18180fe89", "scanner": "scanner-primary", "fingerprint": "3720b43a8da078ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-81727"]}}, {"ruleId": "scanner-71fa1ff4e19f97eb", "level": "error", "message": {"text": "CVE-2025-67221: orjson 3.11.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9cb7cc5a2cf43eb1", "scanner": "scanner-primary", "fingerprint": "71fa1ff4e19f97eb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-67221"]}}, {"ruleId": "scanner-3b1bed581e973b27", "level": "error", "message": {"text": "CVE-2026-25990: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "eeee106c0d043a5d", "scanner": "scanner-primary", "fingerprint": "3b1bed581e973b27", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25990"]}}, {"ruleId": "scanner-a034b12e8434a0c0", "level": "error", "message": {"text": "CVE-2026-40192: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1d084d05c9408c46", "scanner": "scanner-primary", "fingerprint": "a034b12e8434a0c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40192"]}}, {"ruleId": "scanner-4873f2bf3b03800e", "level": "error", "message": {"text": "CVE-2026-42311: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "936ca35c09caec54", "scanner": "scanner-primary", "fingerprint": "4873f2bf3b03800e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42311"]}}, {"ruleId": "scanner-a0182089ec7069b6", "level": "error", "message": {"text": "CVE-2026-54058: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "18e896c4685a7395", "scanner": "scanner-primary", "fingerprint": "a0182089ec7069b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54058"]}}, {"ruleId": "scanner-92ff301a6892f5ef", "level": "error", "message": {"text": "CVE-2026-54059: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3328b3887170f7bc", "scanner": "scanner-primary", "fingerprint": "92ff301a6892f5ef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54059"]}}, {"ruleId": "scanner-d03265e5499535d3", "level": "error", "message": {"text": "CVE-2026-54060: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "ecfe4250c18f8ab1", "scanner": "scanner-primary", "fingerprint": "d03265e5499535d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54060"]}}, {"ruleId": "scanner-4f221fa12e272fcc", "level": "error", "message": {"text": "CVE-2026-55379: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "40c16f2ba6da3e36", "scanner": "scanner-primary", "fingerprint": "4f221fa12e272fcc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55379"]}}, {"ruleId": "scanner-5079ee6d2e7042bd", "level": "error", "message": {"text": "CVE-2026-55380: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "6e391a902fc9be67", "scanner": "scanner-primary", "fingerprint": "5079ee6d2e7042bd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55380"]}}, {"ruleId": "scanner-9b43f796ea62d74d", "level": "error", "message": {"text": "CVE-2026-59197: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c983421e8e8f3a68", "scanner": "scanner-primary", "fingerprint": "9b43f796ea62d74d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59197"]}}, {"ruleId": "scanner-804417a51820c285", "level": "error", "message": {"text": "CVE-2026-59199: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b120f18961ce10b4", "scanner": "scanner-primary", "fingerprint": "804417a51820c285", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59199"]}}, {"ruleId": "scanner-7ac4ad31f656f35b", "level": "error", "message": {"text": "CVE-2026-59200: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3759fd726e1f79fd", "scanner": "scanner-primary", "fingerprint": "7ac4ad31f656f35b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59200"]}}, {"ruleId": "scanner-de19ba5b9679573a", "level": "error", "message": {"text": "CVE-2026-59204: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "ab9c48124ccf04f9", "scanner": "scanner-primary", "fingerprint": "de19ba5b9679573a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59204"]}}, {"ruleId": "scanner-72998bb8c5587908", "level": "error", "message": {"text": "CVE-2026-59205: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f00218151ea10ec0", "scanner": "scanner-primary", "fingerprint": "72998bb8c5587908", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59205"]}}, {"ruleId": "scanner-58267cc749954709", "level": "warning", "message": {"text": "CVE-2026-42308: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "7c410a56ffbf2444", "scanner": "scanner-primary", "fingerprint": "58267cc749954709", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42308"]}}, {"ruleId": "scanner-852a673176eaf328", "level": "warning", "message": {"text": "CVE-2026-42309: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "84c50d196d6535e0", "scanner": "scanner-primary", "fingerprint": "852a673176eaf328", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42309"]}}, {"ruleId": "scanner-73cf4a393c7645d6", "level": "warning", "message": {"text": "CVE-2026-42310: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f51c16b1833a5ee3", "scanner": "scanner-primary", "fingerprint": "73cf4a393c7645d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42310"]}}, {"ruleId": "scanner-f066121357c542d4", "level": "warning", "message": {"text": "CVE-2026-55798: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4103b3c0686c86ae", "scanner": "scanner-primary", "fingerprint": "f066121357c542d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55798"]}}, {"ruleId": "scanner-403dce1ed88524bb", "level": "warning", "message": {"text": "CVE-2026-59198: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1075700745c3e25f", "scanner": "scanner-primary", "fingerprint": "403dce1ed88524bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59198"]}}, {"ruleId": "scanner-ba15c727dbc8e361", "level": "warning", "message": {"text": "CVE-2026-59203: pillow 12.1.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d5690a786c344129", "scanner": "scanner-primary", "fingerprint": "ba15c727dbc8e361", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59203"]}}, {"ruleId": "scanner-63deee79fd3444ad", "level": "error", "message": {"text": "CVE-2026-25087: pyarrow 22.0.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d3d6a3952ae15a33", "scanner": "scanner-primary", "fingerprint": "63deee79fd3444ad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25087"]}}, {"ruleId": "scanner-9840bc76cec33681", "level": "error", "message": {"text": "CVE-2026-23490: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9ba4c6d7c409be5b", "scanner": "scanner-primary", "fingerprint": "9840bc76cec33681", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23490"]}}, {"ruleId": "scanner-8b44fde6eb531940", "level": "error", "message": {"text": "CVE-2026-30922: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "dba3b5f882f7858f", "scanner": "scanner-primary", "fingerprint": "8b44fde6eb531940", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-30922"]}}, {"ruleId": "scanner-7fa67243b1c583cb", "level": "error", "message": {"text": "CVE-2026-59884: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d50d25e16a417275", "scanner": "scanner-primary", "fingerprint": "7fa67243b1c583cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59884"]}}, {"ruleId": "scanner-58f293a615917d9b", "level": "error", "message": {"text": "CVE-2026-59885: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "308713ff52441cd1", "scanner": "scanner-primary", "fingerprint": "58f293a615917d9b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59885"]}}, {"ruleId": "scanner-cf7cc9b2811b837d", "level": "error", "message": {"text": "CVE-2026-59886: pyasn1 0.6.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4f85e1d838003335", "scanner": "scanner-primary", "fingerprint": "cf7cc9b2811b837d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59886"]}}, {"ruleId": "scanner-340c92277b331eb0", "level": "warning", "message": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.12.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "09c7fca7932a05b1", "scanner": "scanner-primary", "fingerprint": "340c92277b331eb0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4xgf-cpjx-pc3j"]}}, {"ruleId": "scanner-86b6da008d33a359", "level": "note", "message": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "6dc3f11daea91f8f", "scanner": "scanner-primary", "fingerprint": "86b6da008d33a359", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4539"]}}, {"ruleId": "scanner-adbe8c02909d4eac", "level": "error", "message": {"text": "CVE-2026-32597: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f9c62e2e5fbdc9b7", "scanner": "scanner-primary", "fingerprint": "adbe8c02909d4eac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-32597"]}}, {"ruleId": "scanner-1560d4b53a5a04a0", "level": "error", "message": {"text": "CVE-2026-48526: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "caa25e05a3d0be19", "scanner": "scanner-primary", "fingerprint": "1560d4b53a5a04a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48526"]}}, {"ruleId": "scanner-ab221fc387c599a4", "level": "warning", "message": {"text": "CVE-2026-48522: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4f7b638965943cf4", "scanner": "scanner-primary", "fingerprint": "ab221fc387c599a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48522"]}}, {"ruleId": "scanner-933436573ec4e821", "level": "warning", "message": {"text": "CVE-2026-48523: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "8f2a0957c00a6eac", "scanner": "scanner-primary", "fingerprint": "933436573ec4e821", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48523"]}}, {"ruleId": "scanner-9353ccfff8b38777", "level": "warning", "message": {"text": "CVE-2026-48525: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "6d5c660b2d7382b4", "scanner": "scanner-primary", "fingerprint": "9353ccfff8b38777", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48525"]}}, {"ruleId": "scanner-d74734504eec8460", "level": "note", "message": {"text": "CVE-2026-48524: pyjwt 2.10.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "6f72cd09fc8cac8c", "scanner": "scanner-primary", "fingerprint": "d74734504eec8460", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48524"]}}, {"ruleId": "scanner-13f61016a7eb6998", "level": "error", "message": {"text": "CVE-2026-59935: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c4769f731f1134af", "scanner": "scanner-primary", "fingerprint": "13f61016a7eb6998", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59935"]}}, {"ruleId": "scanner-caef7cd7a74af7db", "level": "error", "message": {"text": "CVE-2026-59936: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1f63741b085cd435", "scanner": "scanner-primary", "fingerprint": "caef7cd7a74af7db", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59936"]}}, {"ruleId": "scanner-fdf4080156d795f0", "level": "warning", "message": {"text": "CVE-2026-24688: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f6fe263d27f6aa1a", "scanner": "scanner-primary", "fingerprint": "fdf4080156d795f0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24688"]}}, {"ruleId": "scanner-f695e2c8563f968b", "level": "warning", "message": {"text": "CVE-2026-27024: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "be60984a1f5eb1c0", "scanner": "scanner-primary", "fingerprint": "f695e2c8563f968b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27024"]}}, {"ruleId": "scanner-3e4762c5d47af52d", "level": "warning", "message": {"text": "CVE-2026-27025: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1e687c3f2ba784e4", "scanner": "scanner-primary", "fingerprint": "3e4762c5d47af52d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27025"]}}, {"ruleId": "scanner-fd17504a676e6672", "level": "warning", "message": {"text": "CVE-2026-27026: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "088974fe480d798a", "scanner": "scanner-primary", "fingerprint": "fd17504a676e6672", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27026"]}}, {"ruleId": "scanner-28a820dad0cbb88d", "level": "warning", "message": {"text": "CVE-2026-27888: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0e0c4687a891cb20", "scanner": "scanner-primary", "fingerprint": "28a820dad0cbb88d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27888"]}}, {"ruleId": "scanner-0a71b1fa0633acf2", "level": "warning", "message": {"text": "CVE-2026-28351: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "12fbac80128b387c", "scanner": "scanner-primary", "fingerprint": "0a71b1fa0633acf2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28351"]}}, {"ruleId": "scanner-581d0fc754c541bb", "level": "warning", "message": {"text": "CVE-2026-28804: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9d9a065dc313ae4a", "scanner": "scanner-primary", "fingerprint": "581d0fc754c541bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28804"]}}, {"ruleId": "scanner-e19df7e5b6a84053", "level": "warning", "message": {"text": "CVE-2026-31826: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5929392d0d1eff51", "scanner": "scanner-primary", "fingerprint": "e19df7e5b6a84053", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31826"]}}, {"ruleId": "scanner-e40ce875bad9a0d9", "level": "warning", "message": {"text": "CVE-2026-33123: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b9bacd1f4442282b", "scanner": "scanner-primary", "fingerprint": "e40ce875bad9a0d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33123"]}}, {"ruleId": "scanner-0c881f4a98d306dc", "level": "warning", "message": {"text": "CVE-2026-33699: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3420ede47db9ae99", "scanner": "scanner-primary", "fingerprint": "0c881f4a98d306dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33699"]}}, {"ruleId": "scanner-46720847cab0bed8", "level": "warning", "message": {"text": "CVE-2026-40260: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "66c1b4d06c2fd632", "scanner": "scanner-primary", "fingerprint": "46720847cab0bed8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40260"]}}, {"ruleId": "scanner-be1ae6f272f6c8f3", "level": "warning", "message": {"text": "CVE-2026-41168: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4a833a4ec0697d67", "scanner": "scanner-primary", "fingerprint": "be1ae6f272f6c8f3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41168"]}}, {"ruleId": "scanner-6bbb6ca8e4a46eb6", "level": "warning", "message": {"text": "CVE-2026-41312: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9548a31ba2cdb3e8", "scanner": "scanner-primary", "fingerprint": "6bbb6ca8e4a46eb6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41312"]}}, {"ruleId": "scanner-8ad86577e7ba0d1e", "level": "warning", "message": {"text": "CVE-2026-41313: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "206d16844a353ae0", "scanner": "scanner-primary", "fingerprint": "8ad86577e7ba0d1e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41313"]}}, {"ruleId": "scanner-b4ad6c7022273e5b", "level": "warning", "message": {"text": "CVE-2026-41314: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e7a3f37b69a90cb1", "scanner": "scanner-primary", "fingerprint": "b4ad6c7022273e5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41314"]}}, {"ruleId": "scanner-8ba6287c55820db6", "level": "warning", "message": {"text": "CVE-2026-48155: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "b0a6d2e6f2942cb3", "scanner": "scanner-primary", "fingerprint": "8ba6287c55820db6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48155"]}}, {"ruleId": "scanner-ce15e173f3649a55", "level": "warning", "message": {"text": "CVE-2026-48156: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "ad4a989756a98091", "scanner": "scanner-primary", "fingerprint": "ce15e173f3649a55", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48156"]}}, {"ruleId": "scanner-59ca66d8a1c1134d", "level": "warning", "message": {"text": "CVE-2026-48735: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3c903c98cc74f1a6", "scanner": "scanner-primary", "fingerprint": "59ca66d8a1c1134d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48735"]}}, {"ruleId": "scanner-bea1a3d3b409e64f", "level": "warning", "message": {"text": "CVE-2026-49460: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "8a97b3be13302df7", "scanner": "scanner-primary", "fingerprint": "bea1a3d3b409e64f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49460"]}}, {"ruleId": "scanner-1be49d770c4aef11", "level": "warning", "message": {"text": "CVE-2026-49461: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e5f8097bacf226fb", "scanner": "scanner-primary", "fingerprint": "1be49d770c4aef11", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49461"]}}, {"ruleId": "scanner-800109fc0ca4a95d", "level": "warning", "message": {"text": "CVE-2026-54530: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "096a5138580434ca", "scanner": "scanner-primary", "fingerprint": "800109fc0ca4a95d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54530"]}}, {"ruleId": "scanner-3041709eb1402e78", "level": "warning", "message": {"text": "CVE-2026-54531: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1508b3173ed97b93", "scanner": "scanner-primary", "fingerprint": "3041709eb1402e78", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54531"]}}, {"ruleId": "scanner-e978bbc64c8ea836", "level": "warning", "message": {"text": "CVE-2026-54651: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9e253c8e478a29e9", "scanner": "scanner-primary", "fingerprint": "e978bbc64c8ea836", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54651"]}}, {"ruleId": "scanner-91504f1935b15cb9", "level": "warning", "message": {"text": "CVE-2026-59937: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e1b735f8b278b478", "scanner": "scanner-primary", "fingerprint": "91504f1935b15cb9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59937"]}}, {"ruleId": "scanner-247182237e96b321", "level": "warning", "message": {"text": "CVE-2026-59938: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "e871f12e3915251f", "scanner": "scanner-primary", "fingerprint": "247182237e96b321", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59938"]}}, {"ruleId": "scanner-f60be5a998e63426", "level": "warning", "message": {"text": "CVE-2026-71852: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c030329b17f9c6c8", "scanner": "scanner-primary", "fingerprint": "f60be5a998e63426", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71852"]}}, {"ruleId": "scanner-589f1eb0731e08a4", "level": "warning", "message": {"text": "CVE-2026-71870: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0628bddb44c63269", "scanner": "scanner-primary", "fingerprint": "589f1eb0731e08a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71870"]}}, {"ruleId": "scanner-310261800682b65a", "level": "warning", "message": {"text": "CVE-2026-82398: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "aaed6d86c6e11000", "scanner": "scanner-primary", "fingerprint": "310261800682b65a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82398"]}}, {"ruleId": "scanner-11df9d8dfdd50ae5", "level": "warning", "message": {"text": "CVE-2026-84309: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3b8dec796d82c220", "scanner": "scanner-primary", "fingerprint": "11df9d8dfdd50ae5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84309"]}}, {"ruleId": "scanner-9e7da752316ac450", "level": "warning", "message": {"text": "CVE-2026-84310: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f13d629032e5b661", "scanner": "scanner-primary", "fingerprint": "9e7da752316ac450", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84310"]}}, {"ruleId": "scanner-c973ddf26bf468dc", "level": "warning", "message": {"text": "CVE-2026-84311: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3d4c929fd86a8d5b", "scanner": "scanner-primary", "fingerprint": "c973ddf26bf468dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84311"]}}, {"ruleId": "scanner-4ad2df3f8aecaa5b", "level": "warning", "message": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "217b34d01584317a", "scanner": "scanner-primary", "fingerprint": "4ad2df3f8aecaa5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jm82-fx9c-mx94"]}}, {"ruleId": "scanner-4961063d03e37444", "level": "note", "message": {"text": "CVE-2026-27628: pypdf 6.6.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "8577f64d844d54cd", "scanner": "scanner-primary", "fingerprint": "4961063d03e37444", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27628"]}}, {"ruleId": "scanner-4d4a477c2f5f55aa", "level": "warning", "message": {"text": "CVE-2026-28684: python-dotenv 1.2.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "a4be7ba1cd6077dc", "scanner": "scanner-primary", "fingerprint": "4d4a477c2f5f55aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28684"]}}, {"ruleId": "scanner-6f79d93b16415f16", "level": "warning", "message": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "a319027b5f382d7a", "scanner": "scanner-primary", "fingerprint": "6f79d93b16415f16", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25645"]}}, {"ruleId": "scanner-281fbd4664dc89fc", "level": "warning", "message": {"text": "CVE-2026-59890: setuptools 80.9.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0d972bb5cf5e15f6", "scanner": "scanner-primary", "fingerprint": "281fbd4664dc89fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59890"]}}, {"ruleId": "scanner-bbdb9bafd28b627b", "level": "error", "message": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "c60e0a5aedb58cff", "scanner": "scanner-primary", "fingerprint": "bbdb9bafd28b627b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49476"]}}, {"ruleId": "scanner-0242309e0098fdc8", "level": "error", "message": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "75ff9cd595e3718e", "scanner": "scanner-primary", "fingerprint": "0242309e0098fdc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49477"]}}, {"ruleId": "scanner-8799013679a249fe", "level": "warning", "message": {"text": "CVE-2026-85999: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f713fbc518c453b7", "scanner": "scanner-primary", "fingerprint": "8799013679a249fe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-85999"]}}, {"ruleId": "scanner-685d46a9efca5381", "level": "warning", "message": {"text": "CVE-2026-86000: soupsieve 2.8.3 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5597ace70e4c3efe", "scanner": "scanner-primary", "fingerprint": "685d46a9efca5381", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-86000"]}}, {"ruleId": "scanner-e54f9aa53e57255d", "level": "error", "message": {"text": "CVE-2026-54284: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "710558676f16a898", "scanner": "scanner-primary", "fingerprint": "e54f9aa53e57255d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54284"]}}, {"ruleId": "scanner-737c27cfaacdb6ec", "level": "error", "message": {"text": "CVE-2026-59893: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "d22f72d48856e6b8", "scanner": "scanner-primary", "fingerprint": "737c27cfaacdb6ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59893"]}}, {"ruleId": "scanner-722ac2385d5138fe", "level": "error", "message": {"text": "CVE-2026-71491: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4019b59ab8da8778", "scanner": "scanner-primary", "fingerprint": "722ac2385d5138fe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71491"]}}, {"ruleId": "scanner-e5519a1ac62bb71b", "level": "warning", "message": {"text": "CVE-2026-59894: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "46e24b7c8ac83cd5", "scanner": "scanner-primary", "fingerprint": "e5519a1ac62bb71b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59894"]}}, {"ruleId": "scanner-e30f10eb8a77abb4", "level": "warning", "message": {"text": "CVE-2026-84305: sqlparse 0.5.5 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0a2b1007e9a72805", "scanner": "scanner-primary", "fingerprint": "e30f10eb8a77abb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84305"]}}, {"ruleId": "scanner-d8562e2f03cb15f5", "level": "error", "message": {"text": "CVE-2026-48818: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "7f2e33753ce98c18", "scanner": "scanner-primary", "fingerprint": "d8562e2f03cb15f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48818"]}}, {"ruleId": "scanner-762c37a1ff8fbeb5", "level": "error", "message": {"text": "CVE-2026-54283: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "31c989d3c5b50030", "scanner": "scanner-primary", "fingerprint": "762c37a1ff8fbeb5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54283"]}}, {"ruleId": "scanner-cdff5f1c1b1ab01d", "level": "warning", "message": {"text": "CVE-2026-48710: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "6127b27e86bc216b", "scanner": "scanner-primary", "fingerprint": "cdff5f1c1b1ab01d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48710"]}}, {"ruleId": "scanner-150c506b39d33237", "level": "warning", "message": {"text": "CVE-2026-48817: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "1129e59ae066dc57", "scanner": "scanner-primary", "fingerprint": "150c506b39d33237", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48817"]}}, {"ruleId": "scanner-91499012b8cbe7f8", "level": "note", "message": {"text": "CVE-2026-54282: starlette 1.0.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "08d41363996398ff", "scanner": "scanner-primary", "fingerprint": "91499012b8cbe7f8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54282"]}}, {"ruleId": "scanner-7d61dc06488b077d", "level": "note", "message": {"text": "CVE-2025-3000: torch 2.11.0 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "19dcaf1a10389792", "scanner": "scanner-primary", "fingerprint": "7d61dc06488b077d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3000"]}}, {"ruleId": "scanner-1e4f9fba94e0da32", "level": "error", "message": {"text": "CVE-2026-31958: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "4262e5dbaf310c80", "scanner": "scanner-primary", "fingerprint": "1e4f9fba94e0da32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31958"]}}, {"ruleId": "scanner-668a26e18dd58999", "level": "error", "message": {"text": "CVE-2026-35536: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0f1aaf6cd5eae1eb", "scanner": "scanner-primary", "fingerprint": "668a26e18dd58999", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35536"]}}, {"ruleId": "scanner-a630b2f7fcafa3cf", "level": "error", "message": {"text": "CVE-2026-49853: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "50b3dd806da93ba9", "scanner": "scanner-primary", "fingerprint": "a630b2f7fcafa3cf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49853"]}}, {"ruleId": "scanner-de4b4ae853b06b1c", "level": "error", "message": {"text": "CVE-2026-49855: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "11203638ab593be2", "scanner": "scanner-primary", "fingerprint": "de4b4ae853b06b1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49855"]}}, {"ruleId": "scanner-c904006295a97efe", "level": "error", "message": {"text": "CVE-2026-82397: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "11ccc93d72788f1b", "scanner": "scanner-primary", "fingerprint": "c904006295a97efe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82397"]}}, {"ruleId": "scanner-78f509dbbf5fcc55", "level": "warning", "message": {"text": "GHSA-78cv-mqj4-43f7: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "f0a0082b7d646366", "scanner": "scanner-primary", "fingerprint": "78f509dbbf5fcc55", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-78cv-mqj4-43f7"]}}, {"ruleId": "scanner-810b38fbec817c7d", "level": "warning", "message": {"text": "GHSA-8423-8fgw-73vq: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "9ff4557db482baec", "scanner": "scanner-primary", "fingerprint": "810b38fbec817c7d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8423-8fgw-73vq"]}}, {"ruleId": "scanner-9ba61d9badeffcee", "level": "warning", "message": {"text": "GHSA-pw6j-qg29-8w7f: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "5bd8d0974be03d66", "scanner": "scanner-primary", "fingerprint": "9ba61d9badeffcee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pw6j-qg29-8w7f"]}}, {"ruleId": "scanner-7987986fe316b676", "level": "note", "message": {"text": "CVE-2026-49854: tornado 6.5.4 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "cc7664a68e96ce5b", "scanner": "scanner-primary", "fingerprint": "7987986fe316b676", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49854"]}}, {"ruleId": "scanner-cca2fbeaec13b81f", "level": "error", "message": {"text": "CVE-2026-4372: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "0db9ec7c089c0874", "scanner": "scanner-primary", "fingerprint": "cca2fbeaec13b81f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4372"]}}, {"ruleId": "scanner-5c773c8434c8ff93", "level": "error", "message": {"text": "CVE-2026-5241: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "565827c47e0957cb", "scanner": "scanner-primary", "fingerprint": "5c773c8434c8ff93", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-5241"]}}, {"ruleId": "scanner-b3fd21ad724a9027", "level": "error", "message": {"text": "CVE-2026-9856: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "3455277391baf8fd", "scanner": "scanner-primary", "fingerprint": "b3fd21ad724a9027", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9856"]}}, {"ruleId": "scanner-a26b0625d2c91097", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.57.1 \u2014 futureagi/uv.lock"}, "properties": {"repobilityId": "84ac78e162dca83e", "scanner": "scanner-primary", "fingerprint": "a26b0625d2c91097", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-49dd93e8d1a5b351", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.base"}, "properties": {"repobilityId": "3100ea6bcb8aaf57", "scanner": "scanner-primary", "fingerprint": "49dd93e8d1a5b351", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2f4d27ad94e31319", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.base"}, "properties": {"repobilityId": "8072c00eff745f5a", "scanner": "scanner-primary", "fingerprint": "2f4d27ad94e31319", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d8bd279dca2eadcf", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.oss"}, "properties": {"repobilityId": "ec8cc112f37a5055", "scanner": "scanner-primary", "fingerprint": "d8bd279dca2eadcf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-451b09a3d6dff267", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.oss"}, "properties": {"repobilityId": "50eedbe404a8c6a6", "scanner": "scanner-primary", "fingerprint": "451b09a3d6dff267", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6bf6dd4b70de2cab", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.simulation-runner"}, "properties": {"repobilityId": "d4a3315eb1390eb3", "scanner": "scanner-primary", "fingerprint": "6bf6dd4b70de2cab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0d1b21cfd9f9e18a", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.simulation-runner"}, "properties": {"repobilityId": "f9a3efaa04c9c0cc", "scanner": "scanner-primary", "fingerprint": "0d1b21cfd9f9e18a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-20a6ee147e7ed98d", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 agentcc-gateway/Dockerfile"}, "properties": {"repobilityId": "27ac20ed9829b412", "scanner": "scanner-primary", "fingerprint": "20a6ee147e7ed98d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0d9065267d50894d", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 agentcc-gateway/Dockerfile"}, "properties": {"repobilityId": "1a3814b61a090ccd", "scanner": "scanner-primary", "fingerprint": "0d9065267d50894d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d24b5fe1835e7803", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 deploy/dev/property-catalog-docker/python-hotfix.Dockerfile"}, "properties": {"repobilityId": "f07cb7dc65ee0e9d", "scanner": "scanner-primary", "fingerprint": "d24b5fe1835e7803", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-9e17af17b611f944", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 deploy/dev/property-catalog-docker/python-hotfix.Dockerfile"}, "properties": {"repobilityId": "34c9210295031b16", "scanner": "scanner-primary", "fingerprint": "9e17af17b611f944", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1e6c097485314193", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 fi-collector/Dockerfile"}, "properties": {"repobilityId": "712ba194c78ca38d", "scanner": "scanner-primary", "fingerprint": "1e6c097485314193", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1ab562e8604d825c", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 frontend/Dockerfile"}, "properties": {"repobilityId": "e91c5ac1beff67a3", "scanner": "scanner-primary", "fingerprint": "1ab562e8604d825c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c600a2e51a504be", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 frontend/Dockerfile"}, "properties": {"repobilityId": "3616a2eaa1dfd770", "scanner": "scanner-primary", "fingerprint": "3c600a2e51a504be", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b88816d5987ba724", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/Dockerfile"}, "properties": {"repobilityId": "ffee9d75f5a3307a", "scanner": "scanner-primary", "fingerprint": "b88816d5987ba724", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-f7d0254a86dc7155", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/Dockerfile"}, "properties": {"repobilityId": "6e92a81ca4c156e8", "scanner": "scanner-primary", "fingerprint": "f7d0254a86dc7155", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2e703e6b765b8343", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/Dockerfile.oss"}, "properties": {"repobilityId": "b6a21250d37a9057", "scanner": "scanner-primary", "fingerprint": "2e703e6b765b8343", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-da5f953428ba9c07", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/Dockerfile.oss"}, "properties": {"repobilityId": "625e505f4100e85f", "scanner": "scanner-primary", "fingerprint": "da5f953428ba9c07", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-105bc26cbd709903", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/code-executor/Dockerfile"}, "properties": {"repobilityId": "89e083b7f22ef657", "scanner": "scanner-primary", "fingerprint": "105bc26cbd709903", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-7e5a0355b392ef27", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/code-executor/Dockerfile"}, "properties": {"repobilityId": "cc9810c1ef86dcd1", "scanner": "scanner-primary", "fingerprint": "7e5a0355b392ef27", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1791266f634f9cb6", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/code-executor/Dockerfile.base"}, "properties": {"repobilityId": "79e64e6671090f3f", "scanner": "scanner-primary", "fingerprint": "1791266f634f9cb6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6a53f1c48835286e", "level": "warning", "message": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 futureagi/code-executor/Dockerfile.base"}, "properties": {"repobilityId": "6ea8dc14734d83b5", "scanner": "scanner-primary", "fingerprint": "6a53f1c48835286e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b8bb1c7c5f54f2ec", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/code-executor/Dockerfile.base"}, "properties": {"repobilityId": "963edfa3b6a3c9ce", "scanner": "scanner-primary", "fingerprint": "b8bb1c7c5f54f2ec", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-fc15f9de493868c6", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile"}, "properties": {"repobilityId": "e57f83dbb227fa1f", "scanner": "scanner-primary", "fingerprint": "fc15f9de493868c6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-991da9034178614f", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile"}, "properties": {"repobilityId": "b40fed360facef42", "scanner": "scanner-primary", "fingerprint": "991da9034178614f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d0046e63011aea5a", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.base"}, "properties": {"repobilityId": "3096aed0556cc7b6", "scanner": "scanner-primary", "fingerprint": "d0046e63011aea5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6e3495690931218b", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.base"}, "properties": {"repobilityId": "1a9e3307cc331df9", "scanner": "scanner-primary", "fingerprint": "6e3495690931218b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-88e1bff566a2356c", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.oss"}, "properties": {"repobilityId": "146118a048c3297f", "scanner": "scanner-primary", "fingerprint": "88e1bff566a2356c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-f0a19351b57fec39", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.oss"}, "properties": {"repobilityId": "c48f937578a5272d", "scanner": "scanner-primary", "fingerprint": "f0a19351b57fec39", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-a5acdae3c2a2019b", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 futureagi/model_serving/Dockerfile.test"}, "properties": {"repobilityId": "a9c03f3ca75035f4", "scanner": "scanner-primary", "fingerprint": "a5acdae3c2a2019b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d5f9fe08116d5b2c", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 futureagi/model_serving/Dockerfile.test"}, "properties": {"repobilityId": "dd7d7a1300d9eb3b", "scanner": "scanner-primary", "fingerprint": "d5f9fe08116d5b2c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2fc930ee6bac175f", "level": "error", "message": {"text": "Secret leak: GitLab Personal Access Token \u2014 .gitleaks.toml"}, "properties": {"repobilityId": "a29ebe5d72d86e8e", "scanner": "scanner-primary", "fingerprint": "2fc930ee6bac175f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-9bc071e240e0a068", "level": "error", "message": {"text": "Secret leak: Stripe Secret Key \u2014 .gitleaks.toml"}, "properties": {"repobilityId": "a160cb175f274890", "scanner": "scanner-primary", "fingerprint": "9bc071e240e0a068", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-30025757f355763f", "level": "error", "message": {"text": "Secret leak: Google (GCP) Service-account \u2014 frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials/CloudStorageCredentials.jsx"}, "properties": {"repobilityId": "92250f3cb3b011ee", "scanner": "scanner-primary", "fingerprint": "30025757f355763f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-0357e073e2a1a4fc", "level": "error", "message": {"text": "Secret leak: Google (GCP) Service-account \u2014 frontend/src/sections/settings/integrations/AddIntegrationWizard/credentials/MessageQueueCredentials.jsx"}, "properties": {"repobilityId": "5a19ea7551fa012a", "scanner": "scanner-primary", "fingerprint": "0357e073e2a1a4fc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-662da348442b75fd", "level": "warning", "message": {"text": "Privileged port 1000 in use"}, "properties": {"repobilityId": "5ac9fc9372cfe169", "scanner": "scanner-primary", "fingerprint": "662da348442b75fd", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a12dd6a25b57ed3d", "level": "warning", "message": {"text": "Privileged port 587 in use"}, "properties": {"repobilityId": "a87a96c3b2e62c08", "scanner": "scanner-primary", "fingerprint": "a12dd6a25b57ed3d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7efc74e57914c21b", "level": "warning", "message": {"text": "Privileged port 120 in use"}, "properties": {"repobilityId": "1b5bc14c8e1d1785", "scanner": "scanner-primary", "fingerprint": "7efc74e57914c21b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/config.example.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e79c71a9813ea954", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "e79c71a9813ea954", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-disposable-domains.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c4c69854348bba7", "level": "warning", "message": {"text": "Privileged port 3 in use"}, "properties": {"repobilityId": "261b7b1c6a18d412", "scanner": "scanner-primary", "fingerprint": "2c4c69854348bba7", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-disposable-domains.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de608e122eb77061", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/future-agi-base:v1.0.4"}, "properties": {"repobilityId": "d3577ebc16dbf652", "scanner": "scanner-primary", "fingerprint": "de608e122eb77061", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08a85be64f7159f7", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.24-alpine"}, "properties": {"repobilityId": "0494b98fab7ab5e8", "scanner": "scanner-primary", "fingerprint": "08a85be64f7159f7", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fi-collector/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-81d8895dfecb8aac", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: gcr.io/distroless/static-debian12:nonroot"}, "properties": {"repobilityId": "e59dafc9f2bf266f", "scanner": "scanner-primary", "fingerprint": "81d8895dfecb8aac", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fi-collector/Dockerfile"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-60427b03771411b6", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "properties": {"repobilityId": "735c01d8531dfd2c", "scanner": "scanner-primary", "fingerprint": "60427b03771411b6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ca248a9abdff92ff", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22.18"}, "properties": {"repobilityId": "7d0d21b76aa544e4", "scanner": "scanner-primary", "fingerprint": "ca248a9abdff92ff", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-b048d166901fd868", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "cf9d20a1aba8f068", "scanner": "scanner-primary", "fingerprint": "b048d166901fd868", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-64922ec5c36c545d", "level": "warning", "message": {"text": "Dockerfile runs as root: futureagi/Dockerfile"}, "properties": {"repobilityId": "9782c1e8628b24df", "scanner": "scanner-primary", "fingerprint": "64922ec5c36c545d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-f7e85f21728af454", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/future-agi-base:v1.0.4"}, "properties": {"repobilityId": "548589ccb809448e", "scanner": "scanner-primary", "fingerprint": "f7e85f21728af454", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62bfeec7b5a13364", "level": "warning", "message": {"text": "Dockerfile runs as root: futureagi/code-executor/Dockerfile"}, "properties": {"repobilityId": "d756d51cf7fb59b1", "scanner": "scanner-primary", "fingerprint": "62bfeec7b5a13364", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e67f53906cb2b714", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/code-executor-base:v1.0.0"}, "properties": {"repobilityId": "5ad46852e4144f4d", "scanner": "scanner-primary", "fingerprint": "e67f53906cb2b714", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/code-executor/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-0cbf405a6b50c720", "level": "warning", "message": {"text": "Dockerfile runs as root: futureagi/model_serving/Dockerfile"}, "properties": {"repobilityId": "02fd4bf8012392d8", "scanner": "scanner-primary", "fingerprint": "0cbf405a6b50c720", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e1e51620bb5f5b02", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: futureagi/serving-base:v1.0.0"}, "properties": {"repobilityId": "fb2ef7c7850d6c02", "scanner": "scanner-primary", "fingerprint": "e1e51620bb5f5b02", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be0dbe47aa5bbaee", "level": "warning", "message": {"text": "Dockerfile runs as root: agentcc-gateway/Dockerfile"}, "properties": {"repobilityId": "a2590ee6df442cbe", "scanner": "scanner-primary", "fingerprint": "be0dbe47aa5bbaee", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-7c3c4b87a149ee6a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.26-alpine"}, "properties": {"repobilityId": "ed26bd200135c4c5", "scanner": "scanner-primary", "fingerprint": "7c3c4b87a149ee6a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-f6b9398eceed8d46", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/test-annotation-lifecycle.mjs:758"}, "properties": {"repobilityId": "89dba475d9b603c3", "scanner": "scanner-primary", "fingerprint": "f6b9398eceed8d46", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/test-annotation-lifecycle.mjs"}, "region": {"startLine": 758}}}]}, {"ruleId": "scanner-fe508711cc1940be", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/test-annotation-rules.mjs:2659"}, "properties": {"repobilityId": "4979f3eb81284dc5", "scanner": "scanner-primary", "fingerprint": "fe508711cc1940be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/test-annotation-rules.mjs"}, "region": {"startLine": 2659}}}]}, {"ruleId": "scanner-7898387b54c1ce97", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-profile-security-smoke.mjs:66"}, "properties": {"repobilityId": "bdd3cc2035c5176a", "scanner": "scanner-primary", "fingerprint": "7898387b54c1ce97", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-profile-security-smoke.mjs"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-f16de277b334504e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-usage-smoke.mjs:66"}, "properties": {"repobilityId": "02de1cc8d0f24316", "scanner": "scanner-primary", "fingerprint": "f16de277b334504e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-workspace-usage-smoke.mjs"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-113249f4c621aa83", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-users-smoke.mjs:37"}, "properties": {"repobilityId": "8f014d8c640702b0", "scanner": "scanner-primary", "fingerprint": "113249f4c621aa83", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-users-smoke.mjs"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-86140eafbf59ecbd", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-ai-providers-smoke.mjs:108"}, "properties": {"repobilityId": "4a96511d55bb2cd9", "scanner": "scanner-primary", "fingerprint": "86140eafbf59ecbd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-workspace-ai-providers-smoke.mjs"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-72f64fedf51e67b8", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-bulk-assign-smoke.mjs:748"}, "properties": {"repobilityId": "98f8035c923586bc", "scanner": "scanner-primary", "fingerprint": "72f64fedf51e67b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-bulk-assign-smoke.mjs"}, "region": {"startLine": 748}}}]}, {"ruleId": "scanner-70218e5501e22feb", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/get-started-smoke.mjs:84"}, "properties": {"repobilityId": "3b5f2d6cc024eb14", "scanner": "scanner-primary", "fingerprint": "70218e5501e22feb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/get-started-smoke.mjs"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-53cb1df648c2782c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-ai-providers-smoke.mjs:79"}, "properties": {"repobilityId": "085c9cb57356836e", "scanner": "scanner-primary", "fingerprint": "53cb1df648c2782c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-global-ai-providers-smoke.mjs"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-c6aab09d62cd80af", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-clone-list-action-smoke.mjs:487"}, "properties": {"repobilityId": "124592e60f23c278", "scanner": "scanner-primary", "fingerprint": "c6aab09d62cd80af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-clone-list-action-smoke.mjs"}, "region": {"startLine": 487}}}]}, {"ruleId": "scanner-a1408d7874a76d31", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-analytics-smoke.mjs:880"}, "properties": {"repobilityId": "4c95a70dbaaa4997", "scanner": "scanner-primary", "fingerprint": "a1408d7874a76d31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-analytics-smoke.mjs"}, "region": {"startLine": 880}}}]}, {"ruleId": "scanner-b52faa70a42ca25f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs:126"}, "properties": {"repobilityId": "2e0e6f7a56c09e07", "scanner": "scanner-primary", "fingerprint": "b52faa70a42ca25f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-c24b50da9326b6dd", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-logs-export-smoke.mjs:876"}, "properties": {"repobilityId": "c218549011359b61", "scanner": "scanner-primary", "fingerprint": "c24b50da9326b6dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-logs-export-smoke.mjs"}, "region": {"startLine": 876}}}]}, {"ruleId": "scanner-6d7231125a40198c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-viewer-role-write-smoke.mjs:278"}, "properties": {"repobilityId": "09815031561f69b4", "scanner": "scanner-primary", "fingerprint": "6d7231125a40198c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-viewer-role-write-smoke.mjs"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-4f271ae3827c5f2c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/voice-path-analysis-smoke.mjs:248"}, "properties": {"repobilityId": "e9fee83e56ff9c31", "scanner": "scanner-primary", "fingerprint": "4f271ae3827c5f2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/voice-path-analysis-smoke.mjs"}, "region": {"startLine": 248}}}]}, {"ruleId": "scanner-ef0e5ee292281152", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-add-evals-task-draft-smoke.mjs:493"}, "properties": {"repobilityId": "e60b9e708dbaee2a", "scanner": "scanner-primary", "fingerprint": "ef0e5ee292281152", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-add-evals-task-draft-smoke.mjs"}, "region": {"startLine": 493}}}]}, {"ruleId": "scanner-e246852662e05ac6", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/composite-eval-create-smoke.mjs:805"}, "properties": {"repobilityId": "ece2359ce40fc2cf", "scanner": "scanner-primary", "fingerprint": "e246852662e05ac6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/composite-eval-create-smoke.mjs"}, "region": {"startLine": 805}}}]}, {"ruleId": "scanner-a7541a12a49650b7", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-projects-smoke.mjs:83"}, "properties": {"repobilityId": "eae958a2fc0f0625", "scanner": "scanner-primary", "fingerprint": "a7541a12a49650b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/prototype-projects-smoke.mjs"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-d10497a78e8a289b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-existing-add-as-new-smoke.mjs:477"}, "properties": {"repobilityId": "2bf79b21ef58dbf3", "scanner": "scanner-primary", "fingerprint": "d10497a78e8a289b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-existing-add-as-new-smoke.mjs"}, "region": {"startLine": 477}}}]}, {"ruleId": "scanner-82e3275126dc2f32", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/error-feed-smoke.mjs:46"}, "properties": {"repobilityId": "e1a84be8f10b8ccc", "scanner": "scanner-primary", "fingerprint": "82e3275126dc2f32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/error-feed-smoke.mjs"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-8732b2a5beafbfa9", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-session-select-all-smoke.mjs:332"}, "properties": {"repobilityId": "b1071c18141ea7ab", "scanner": "scanner-primary", "fingerprint": "8732b2a5beafbfa9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-session-select-all-smoke.mjs"}, "region": {"startLine": 332}}}]}, {"ruleId": "scanner-6b1366c693685e91", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-sessions-smoke.mjs:769"}, "properties": {"repobilityId": "5a1ec6ce51b422eb", "scanner": "scanner-primary", "fingerprint": "6b1366c693685e91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-sessions-smoke.mjs"}, "region": {"startLine": 769}}}]}, {"ruleId": "scanner-7efa645ba51fff08", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/tasks-smoke.mjs:79"}, "properties": {"repobilityId": "a56bce6958c9498e", "scanner": "scanner-primary", "fingerprint": "7efa645ba51fff08", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/tasks-smoke.mjs"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-39edaaa3ba239629", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-api-keys-smoke.mjs:285"}, "properties": {"repobilityId": "9a063361b7264613", "scanner": "scanner-primary", "fingerprint": "39edaaa3ba239629", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-api-keys-smoke.mjs"}, "region": {"startLine": 285}}}]}, {"ruleId": "scanner-094949378a4e7409", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-mcp-smoke.mjs:581"}, "properties": {"repobilityId": "45778c45d288d9ae", "scanner": "scanner-primary", "fingerprint": "094949378a4e7409", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-mcp-smoke.mjs"}, "region": {"startLine": 581}}}]}, {"ruleId": "scanner-268e4b86b8fac1dc", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-file-upload-smoke.mjs:254"}, "properties": {"repobilityId": "3fa9aefbc54f5f8a", "scanner": "scanner-primary", "fingerprint": "268e4b86b8fac1dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/falcon-ai-file-upload-smoke.mjs"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-8407a284ee251e11", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-providers-smoke.mjs:376"}, "properties": {"repobilityId": "33fdbc2da4da40ac", "scanner": "scanner-primary", "fingerprint": "8407a284ee251e11", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-providers-smoke.mjs"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-88ba5d76d03e9ce4", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-charts-smoke.mjs:65"}, "properties": {"repobilityId": "e4f387b9e9a5692a", "scanner": "scanner-primary", "fingerprint": "88ba5d76d03e9ce4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-charts-smoke.mjs"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-38f780afe6aaa70a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-copy-new-detail-smoke.mjs:498"}, "properties": {"repobilityId": "af99ccd41ace409f", "scanner": "scanner-primary", "fingerprint": "38f780afe6aaa70a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-copy-new-detail-smoke.mjs"}, "region": {"startLine": 498}}}]}, {"ruleId": "scanner-3b73e27376945e64", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-custom-properties-smoke.mjs:535"}, "properties": {"repobilityId": "735a50ccdfcfec2a", "scanner": "scanner-primary", "fingerprint": "3b73e27376945e64", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-custom-properties-smoke.mjs"}, "region": {"startLine": 535}}}]}, {"ruleId": "scanner-e8b7dd62a3726f7e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-query-share-state-smoke.mjs:108"}, "properties": {"repobilityId": "23873649de9d8a2a", "scanner": "scanner-primary", "fingerprint": "e8b7dd62a3726f7e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dashboard-query-share-state-smoke.mjs"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-d5f2915c238cf63f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/error-feed-linear-connect-smoke.mjs:190"}, "properties": {"repobilityId": "901763cb4130f5e3", "scanner": "scanner-primary", "fingerprint": "d5f2915c238cf63f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/error-feed-linear-connect-smoke.mjs"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-277a1ecc25530c09", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-column-menu-detail-smoke.mjs:485"}, "properties": {"repobilityId": "d82d27d90ea05e00", "scanner": "scanner-primary", "fingerprint": "277a1ecc25530c09", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-column-menu-detail-smoke.mjs"}, "region": {"startLine": 485}}}]}, {"ruleId": "scanner-06a063dc316acd09", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-webhooks-delivery-smoke.mjs:803"}, "properties": {"repobilityId": "1fac6c106dae0261", "scanner": "scanner-primary", "fingerprint": "06a063dc316acd09", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-webhooks-delivery-smoke.mjs"}, "region": {"startLine": 803}}}]}, {"ruleId": "scanner-8ce6232a8ec335d5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-falcon-connectors-smoke.mjs:490"}, "properties": {"repobilityId": "94f4780838dee4ed", "scanner": "scanner-primary", "fingerprint": "8ce6232a8ec335d5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-falcon-connectors-smoke.mjs"}, "region": {"startLine": 490}}}]}, {"ruleId": "scanner-b3214759cba1933a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-billing-budget-crud-smoke.mjs:68"}, "properties": {"repobilityId": "97c50ad535ecb10b", "scanner": "scanner-primary", "fingerprint": "b3214759cba1933a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-billing-budget-crud-smoke.mjs"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-a7c8ef0ee6b64059", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-list-bulk-delete-smoke.mjs:621"}, "properties": {"repobilityId": "8e84cba63adb2a01", "scanner": "scanner-primary", "fingerprint": "a7c8ef0ee6b64059", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-list-bulk-delete-smoke.mjs"}, "region": {"startLine": 621}}}]}, {"ruleId": "scanner-f382e108a6efdeec", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-settings-mutation-smoke.mjs:550"}, "properties": {"repobilityId": "1dc27ac6519789f8", "scanner": "scanner-primary", "fingerprint": "f382e108a6efdeec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-settings-mutation-smoke.mjs"}, "region": {"startLine": 550}}}]}, {"ruleId": "scanner-e7bee355a208c686", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-edit-column-type-detail-smoke.mjs:442"}, "properties": {"repobilityId": "412f459ebc364023", "scanner": "scanner-primary", "fingerprint": "e7bee355a208c686", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-edit-column-type-detail-smoke.mjs"}, "region": {"startLine": 442}}}]}, {"ruleId": "scanner-74d354deed7d04f5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-budgets-smoke.mjs:502"}, "properties": {"repobilityId": "a06e021da7859271", "scanner": "scanner-primary", "fingerprint": "74d354deed7d04f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-budgets-smoke.mjs"}, "region": {"startLine": 502}}}]}, {"ruleId": "scanner-8c567fb5d1629e62", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-session-trace-id-smoke.mjs:210"}, "properties": {"repobilityId": "c4a08012021b4d4d", "scanner": "scanner-primary", "fingerprint": "8c567fb5d1629e62", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-session-trace-id-smoke.mjs"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-53555a1f0bcaa942", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-guardrails-smoke.mjs:414"}, "properties": {"repobilityId": "faf8644b3ffd914e", "scanner": "scanner-primary", "fingerprint": "53555a1f0bcaa942", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-guardrails-smoke.mjs"}, "region": {"startLine": 414}}}]}, {"ruleId": "scanner-9296030d5e556c1a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-filters-smoke.mjs:39"}, "properties": {"repobilityId": "b376c4fed5844cc6", "scanner": "scanner-primary", "fingerprint": "9296030d5e556c1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-filters-smoke.mjs"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-305f44de923e82d5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs:319"}, "properties": {"repobilityId": "2ec172d1483f019f", "scanner": "scanner-primary", "fingerprint": "305f44de923e82d5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-0cdb0a69c2ec1dab", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs:488"}, "properties": {"repobilityId": "2a16e5bb04963f86", "scanner": "scanner-primary", "fingerprint": "0cdb0a69c2ec1dab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-annotation-label-columns-smoke.mjs"}, "region": {"startLine": 488}}}]}, {"ruleId": "scanner-55cf94d6baba79d6", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-ee-license-crud-smoke.mjs:85"}, "properties": {"repobilityId": "18982f544f709588", "scanner": "scanner-primary", "fingerprint": "55cf94d6baba79d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-ee-license-crud-smoke.mjs"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-43ba923dc1dea7d1", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-merge-existing-detail-smoke.mjs:491"}, "properties": {"repobilityId": "d3789af64711edb0", "scanner": "scanner-primary", "fingerprint": "43ba923dc1dea7d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-merge-existing-detail-smoke.mjs"}, "region": {"startLine": 491}}}]}, {"ruleId": "scanner-ece95f765931b08d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-list-detail-date-smoke.mjs:78"}, "properties": {"repobilityId": "b1b71831f1c8dec6", "scanner": "scanner-primary", "fingerprint": "ece95f765931b08d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dashboard-list-detail-date-smoke.mjs"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-9c259cab64f8539d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-providers-mutation-smoke.mjs:435"}, "properties": {"repobilityId": "a69e00dc2ee06e2d", "scanner": "scanner-primary", "fingerprint": "9c259cab64f8539d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-providers-mutation-smoke.mjs"}, "region": {"startLine": 435}}}]}, {"ruleId": "scanner-d731113a173d7ded", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-submit-workflow-smoke.mjs:36"}, "properties": {"repobilityId": "95015a60ffd80d1d", "scanner": "scanner-primary", "fingerprint": "d731113a173d7ded", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-submit-workflow-smoke.mjs"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-455b2fe27b8f4a73", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/onboarding-logout-smoke.mjs:377"}, "properties": {"repobilityId": "5f3214c21b3f1424", "scanner": "scanner-primary", "fingerprint": "455b2fe27b8f4a73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/onboarding-logout-smoke.mjs"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-c1f439340c7b4336", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-create-duplicate-drawer-smoke.mjs:621"}, "properties": {"repobilityId": "63be0abba3fc6e1a", "scanner": "scanner-primary", "fingerprint": "c1f439340c7b4336", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-queue-create-duplicate-drawer-smoke.mjs"}, "region": {"startLine": 621}}}]}, {"ruleId": "scanner-1dc7a5180a7618ca", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/composite-eval-smoke.mjs:81"}, "properties": {"repobilityId": "fd11634eaf25f336", "scanner": "scanner-primary", "fingerprint": "1dc7a5180a7618ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/composite-eval-smoke.mjs"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-9bdf4faa25df2d8d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-duplicate-rows-detail-smoke.mjs:461"}, "properties": {"repobilityId": "02f67046eec5c2ab", "scanner": "scanner-primary", "fingerprint": "9bdf4faa25df2d8d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-duplicate-rows-detail-smoke.mjs"}, "region": {"startLine": 461}}}]}, {"ruleId": "scanner-cc8183593bf02a81", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-skills-smoke.mjs:364"}, "properties": {"repobilityId": "ad9e34a980f05bce", "scanner": "scanner-primary", "fingerprint": "cc8183593bf02a81", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/falcon-ai-skills-smoke.mjs"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-4e79a5568c7f44d6", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-integrations-lifecycle-smoke.mjs:90"}, "properties": {"repobilityId": "f455e2efb30f916e", "scanner": "scanner-primary", "fingerprint": "4e79a5568c7f44d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-global-integrations-lifecycle-smoke.mjs"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-52f2ec6410a0f72b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-billing-pricing-licenses-smoke.mjs:186"}, "properties": {"repobilityId": "71dfa0f253d10b4d", "scanner": "scanner-primary", "fingerprint": "52f2ec6410a0f72b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-billing-pricing-licenses-smoke.mjs"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-edc59ad1e0a7c888", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/alerts-smoke.mjs:55"}, "properties": {"repobilityId": "50db5e8b95866853", "scanner": "scanner-primary", "fingerprint": "edc59ad1e0a7c888", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/alerts-smoke.mjs"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-9e46b8b049e26595", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-annotations-preview-smoke.mjs:552"}, "properties": {"repobilityId": "6bdf78213b75f854", "scanner": "scanner-primary", "fingerprint": "9e46b8b049e26595", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-annotations-preview-smoke.mjs"}, "region": {"startLine": 552}}}]}, {"ruleId": "scanner-a3d639b4612a7fb3", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-voice-smoke.mjs:39"}, "properties": {"repobilityId": "a01763e70f844248", "scanner": "scanner-primary", "fingerprint": "a3d639b4612a7fb3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-voice-smoke.mjs"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-16b9f70408067c7c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/tasks-lifecycle-mutation-smoke.mjs:406"}, "properties": {"repobilityId": "c191b0cb37482be3", "scanner": "scanner-primary", "fingerprint": "16b9f70408067c7c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/tasks-lifecycle-mutation-smoke.mjs"}, "region": {"startLine": 406}}}]}, {"ruleId": "scanner-e44a9debb3cc55c7", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/resources-docs-help-smoke.mjs:32"}, "properties": {"repobilityId": "e5c832416908dcbc", "scanner": "scanner-primary", "fingerprint": "e44a9debb3cc55c7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/resources-docs-help-smoke.mjs"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-e1f0ebd6980893d6", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-global-integrations-smoke.mjs:59"}, "properties": {"repobilityId": "a90017333564e1cb", "scanner": "scanner-primary", "fingerprint": "e1f0ebd6980893d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-global-integrations-smoke.mjs"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-46610cb5c37339e7", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-user-management-smoke.mjs:124"}, "properties": {"repobilityId": "cadebc6588d1d086", "scanner": "scanner-primary", "fingerprint": "46610cb5c37339e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-user-management-smoke.mjs"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-f0cd8b0bb7cb7f5f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/alerts-lifecycle-mutation-smoke.mjs:55"}, "properties": {"repobilityId": "e1551c022544eeb8", "scanner": "scanner-primary", "fingerprint": "f0cd8b0bb7cb7f5f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/alerts-lifecycle-mutation-smoke.mjs"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-8b01b17318dab7b5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-charts-filter-smoke.mjs:54"}, "properties": {"repobilityId": "171429d0cc3af080", "scanner": "scanner-primary", "fingerprint": "8b01b17318dab7b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-charts-filter-smoke.mjs"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-0297a5539778945a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-manual-create-smoke.mjs:346"}, "properties": {"repobilityId": "358b50e6beb30ada", "scanner": "scanner-primary", "fingerprint": "0297a5539778945a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-manual-create-smoke.mjs"}, "region": {"startLine": 346}}}]}, {"ruleId": "scanner-60ffc1d8f378688d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prompt-workbench-smoke.mjs:914"}, "properties": {"repobilityId": "048db5362af09023", "scanner": "scanner-primary", "fingerprint": "60ffc1d8f378688d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/prompt-workbench-smoke.mjs"}, "region": {"startLine": 914}}}]}, {"ruleId": "scanner-6aeb98e697ba6497", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-file-row-upload-detail-smoke.mjs:882"}, "properties": {"repobilityId": "adc78842c59b8fff", "scanner": "scanner-primary", "fingerprint": "6aeb98e697ba6497", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-file-row-upload-detail-smoke.mjs"}, "region": {"startLine": 882}}}]}, {"ruleId": "scanner-6907ee0698d2979e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-projects-smoke.mjs:58"}, "properties": {"repobilityId": "02761a7aee5cf04e", "scanner": "scanner-primary", "fingerprint": "6907ee0698d2979e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-projects-smoke.mjs"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-a1f4a38347f1739b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-overview-smoke.mjs:347"}, "properties": {"repobilityId": "eb93cbbb9bd0a1c6", "scanner": "scanner-primary", "fingerprint": "a1f4a38347f1739b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-overview-smoke.mjs"}, "region": {"startLine": 347}}}]}, {"ruleId": "scanner-89705e381163e968", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-playground-versions-smoke.mjs:90"}, "properties": {"repobilityId": "8793859b74b4b42a", "scanner": "scanner-primary", "fingerprint": "89705e381163e968", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/agents-playground-versions-smoke.mjs"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-ef02b1f31ddbe2c9", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/models-route-smoke.mjs:49"}, "properties": {"repobilityId": "3e6eea894830edf0", "scanner": "scanner-primary", "fingerprint": "ef02b1f31ddbe2c9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/models-route-smoke.mjs"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-e9c42e01383a4fd1", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-label-archive-restore-smoke.mjs:252"}, "properties": {"repobilityId": "13f5eeb6c25bd420", "scanner": "scanner-primary", "fingerprint": "e9c42e01383a4fd1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-label-archive-restore-smoke.mjs"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-e08d149f6dd4f879", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-session-smoke.mjs:40"}, "properties": {"repobilityId": "c0096655aef9fbb8", "scanner": "scanner-primary", "fingerprint": "e08d149f6dd4f879", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-session-smoke.mjs"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-d17704014dd7b378", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-smoke.mjs:124"}, "properties": {"repobilityId": "17f25be80f7df42f", "scanner": "scanner-primary", "fingerprint": "d17704014dd7b378", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-workspace-smoke.mjs"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-1423b051309892f9", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-scenarios-detail-smoke.mjs:243"}, "properties": {"repobilityId": "141454f273358c85", "scanner": "scanner-primary", "fingerprint": "1423b051309892f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/simulate-scenarios-detail-smoke.mjs"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-df5102b3a74bb681", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-simulation-content-smoke.mjs:256"}, "properties": {"repobilityId": "d881767d575ee897", "scanner": "scanner-primary", "fingerprint": "df5102b3a74bb681", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-simulation-content-smoke.mjs"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-b0609cb4c48abf38", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queues-list-search-detail-smoke.mjs:714"}, "properties": {"repobilityId": "bcf6215ec5fecc9b", "scanner": "scanner-primary", "fingerprint": "b0609cb4c48abf38", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-queues-list-search-detail-smoke.mjs"}, "region": {"startLine": 714}}}]}, {"ruleId": "scanner-6bc4c9c23e4312ed", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-row-detail-drawer-smoke.mjs:457"}, "properties": {"repobilityId": "103f6a4040b1bfbb", "scanner": "scanner-primary", "fingerprint": "6bc4c9c23e4312ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-row-detail-drawer-smoke.mjs"}, "region": {"startLine": 457}}}]}, {"ruleId": "scanner-400b044a314f89ac", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-project-configure-delete-smoke.mjs:347"}, "properties": {"repobilityId": "402679bd7f8e4922", "scanner": "scanner-primary", "fingerprint": "400b044a314f89ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/prototype-project-configure-delete-smoke.mjs"}, "region": {"startLine": 347}}}]}, {"ruleId": "scanner-3fa5dbc15853efc7", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-keys-smoke.mjs:455"}, "properties": {"repobilityId": "29def2fa100164f7", "scanner": "scanner-primary", "fingerprint": "3fa5dbc15853efc7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-keys-smoke.mjs"}, "region": {"startLine": 455}}}]}, {"ruleId": "scanner-a040f02971b0d587", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-rule-run-now-smoke.mjs:281"}, "properties": {"repobilityId": "d1e792c14bfc4583", "scanner": "scanner-primary", "fingerprint": "a040f02971b0d587", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-rule-run-now-smoke.mjs"}, "region": {"startLine": 281}}}]}, {"ruleId": "scanner-6a71bfed2974d6cd", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-import-existing-detail-smoke.mjs:527"}, "properties": {"repobilityId": "e64b13baea28e3b4", "scanner": "scanner-primary", "fingerprint": "6a71bfed2974d6cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-import-existing-detail-smoke.mjs"}, "region": {"startLine": 527}}}]}, {"ruleId": "scanner-c97b08d17bd8a0b1", "level": "warning", "message": {"text": "Possible secret in frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs"}, "properties": {"repobilityId": "45508b2bf0d29710", "scanner": "scanner-primary", "fingerprint": "c97b08d17bd8a0b1", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs"}, "region": {"startLine": 390}}}]}, {"ruleId": "scanner-560c31491c265b34", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs:641"}, "properties": {"repobilityId": "d43332f38167d3cc", "scanner": "scanner-primary", "fingerprint": "560c31491c265b34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-settings-smoke.mjs"}, "region": {"startLine": 641}}}]}, {"ruleId": "scanner-285f29e9a67d686d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-mcp-mutation-smoke.mjs:589"}, "properties": {"repobilityId": "31fc6cc96f7357d3", "scanner": "scanner-primary", "fingerprint": "285f29e9a67d686d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-mcp-mutation-smoke.mjs"}, "region": {"startLine": 589}}}]}, {"ruleId": "scanner-79e1b451937cfa8b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-personas-lifecycle-smoke.mjs:238"}, "properties": {"repobilityId": "d3f9548de96cb202", "scanner": "scanner-primary", "fingerprint": "79e1b451937cfa8b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/simulate-personas-lifecycle-smoke.mjs"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-ba764b451cb710bf", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-fallbacks-smoke.mjs:498"}, "properties": {"repobilityId": "1e52efbc6fb80aef", "scanner": "scanner-primary", "fingerprint": "ba764b451cb710bf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-fallbacks-smoke.mjs"}, "region": {"startLine": 498}}}]}, {"ruleId": "scanner-1d62c11650631441", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-self-review-block-smoke.mjs:235"}, "properties": {"repobilityId": "db7e826878067500", "scanner": "scanner-primary", "fingerprint": "1d62c11650631441", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-self-review-block-smoke.mjs"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-dd2712d3ead84290", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-detail-smoke.mjs:47"}, "properties": {"repobilityId": "1ab5ff1647509f95", "scanner": "scanner-primary", "fingerprint": "dd2712d3ead84290", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/eval-detail-smoke.mjs"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-ce491006503774c5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-monitoring-mutation-smoke.mjs:503"}, "properties": {"repobilityId": "f850042567fb50ab", "scanner": "scanner-primary", "fingerprint": "ce491006503774c5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-monitoring-mutation-smoke.mjs"}, "region": {"startLine": 503}}}]}, {"ruleId": "scanner-13e246b03ee857de", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-review-flow-smoke.mjs:380"}, "properties": {"repobilityId": "ce3d1add596e397f", "scanner": "scanner-primary", "fingerprint": "13e246b03ee857de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-review-flow-smoke.mjs"}, "region": {"startLine": 380}}}]}, {"ruleId": "scanner-c9d817c11c0b6cee", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-run-detail-actions-smoke.mjs:561"}, "properties": {"repobilityId": "94865f0cce6e8def", "scanner": "scanner-primary", "fingerprint": "c9d817c11c0b6cee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/prototype-run-detail-actions-smoke.mjs"}, "region": {"startLine": 561}}}]}, {"ruleId": "scanner-49e22baab0e797f8", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/annotation-direct-call-queue-source-smoke.mjs:275"}, "properties": {"repobilityId": "6e2f853ffccf3478", "scanner": "scanner-primary", "fingerprint": "49e22baab0e797f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-direct-call-queue-source-smoke.mjs"}, "region": {"startLine": 275}}}]}, {"ruleId": "scanner-90df4fadac00d0ae", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-trace-full-page-smoke.mjs:280"}, "properties": {"repobilityId": "428e23dacc5fa29c", "scanner": "scanner-primary", "fingerprint": "90df4fadac00d0ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-trace-full-page-smoke.mjs"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-502dd9369a275854", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-run-tests-read-smoke.mjs:353"}, "properties": {"repobilityId": "03eb4d97bff32245", "scanner": "scanner-primary", "fingerprint": "502dd9369a275854", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/simulate-run-tests-read-smoke.mjs"}, "region": {"startLine": 353}}}]}, {"ruleId": "scanner-85ab2ecdc7d15166", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-deep-smoke.spec.js:24"}, "properties": {"repobilityId": "2ce266a8d5901940", "scanner": "scanner-primary", "fingerprint": "85ab2ecdc7d15166", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-deep-smoke.spec.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-7832ee9441591379", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-guardrails-mutation-smoke.mjs:519"}, "properties": {"repobilityId": "c87324869d6cc946", "scanner": "scanner-primary", "fingerprint": "7832ee9441591379", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-guardrails-mutation-smoke.mjs"}, "region": {"startLine": 519}}}]}, {"ruleId": "scanner-52bdacba85125afb", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-add-static-column-detail-smoke.mjs:443"}, "properties": {"repobilityId": "cc9e5f75c6090847", "scanner": "scanner-primary", "fingerprint": "52bdacba85125afb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-add-static-column-detail-smoke.mjs"}, "region": {"startLine": 443}}}]}, {"ruleId": "scanner-f7d842879a943611", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-list-create-delete-smoke.mjs:762"}, "properties": {"repobilityId": "6fc56a83e1421604", "scanner": "scanner-primary", "fingerprint": "f7d842879a943611", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/eval-list-create-delete-smoke.mjs"}, "region": {"startLine": 762}}}]}, {"ruleId": "scanner-b815764f68834271", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mjs:54"}, "properties": {"repobilityId": "f5c5d2fba781ead1", "scanner": "scanner-primary", "fingerprint": "b815764f68834271", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mjs"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-c0c750da52fc80e0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mjs:277"}, "properties": {"repobilityId": "a1c5477586a9e9a7", "scanner": "scanner-primary", "fingerprint": "c0c750da52fc80e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-workspace-custom-models-crud-smoke.mjs"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-c0489a6dfd1a8e6a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/knowledge-base-entitlement-smoke.mjs:47"}, "properties": {"repobilityId": "9925c314849afdc4", "scanner": "scanner-primary", "fingerprint": "c0489a6dfd1a8e6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/knowledge-base-entitlement-smoke.mjs"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-b8af30229eaa6ea6", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dataset-synthetic-config-smoke.mjs:859"}, "properties": {"repobilityId": "60b2e615664c08b4", "scanner": "scanner-primary", "fingerprint": "b8af30229eaa6ea6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dataset-synthetic-config-smoke.mjs"}, "region": {"startLine": 859}}}]}, {"ruleId": "scanner-9b91cab38af23b2e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-ground-truth-smoke.mjs:62"}, "properties": {"repobilityId": "b46564f0c18bda88", "scanner": "scanner-primary", "fingerprint": "9b91cab38af23b2e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/eval-ground-truth-smoke.mjs"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-b7545014cee193e4", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/dashboard-widget-editor-smoke.mjs:81"}, "properties": {"repobilityId": "4bf42d440286107d", "scanner": "scanner-primary", "fingerprint": "b7545014cee193e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/dashboard-widget-editor-smoke.mjs"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-d5f5c7d6d2062620", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/simulate-agent-definitions-lifecycle-smoke.mjs:341"}, "properties": {"repobilityId": "73354b1532ea5a68", "scanner": "scanner-primary", "fingerprint": "d5f5c7d6d2062620", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/simulate-agent-definitions-lifecycle-smoke.mjs"}, "region": {"startLine": 341}}}]}, {"ruleId": "scanner-0134ce50620c5c2f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/eval-groups-smoke.mjs:57"}, "properties": {"repobilityId": "021ecb815f6a8116", "scanner": "scanner-primary", "fingerprint": "0134ce50620c5c2f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/eval-groups-smoke.mjs"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-e27f27adf3dea37c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-workspace-layout-smoke.mjs:37"}, "properties": {"repobilityId": "b42e7026b5865557", "scanner": "scanner-primary", "fingerprint": "e27f27adf3dea37c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-workspace-layout-smoke.mjs"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-9fe3971373feba12", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/observe-annotations-feedback-smoke.mjs:216"}, "properties": {"repobilityId": "9710c07e02685add", "scanner": "scanner-primary", "fingerprint": "9fe3971373feba12", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/observe-annotations-feedback-smoke.mjs"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-bab7c83d99ba94a5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-export-download-smoke.mjs:411"}, "properties": {"repobilityId": "8274a304d3cdf500", "scanner": "scanner-primary", "fingerprint": "bab7c83d99ba94a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-queue-export-download-smoke.mjs"}, "region": {"startLine": 411}}}]}, {"ruleId": "scanner-3ea95dd6028c3971", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-budgets-mutation-smoke.mjs:490"}, "properties": {"repobilityId": "2421f1c667359ae6", "scanner": "scanner-primary", "fingerprint": "3ea95dd6028c3971", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-budgets-mutation-smoke.mjs"}, "region": {"startLine": 490}}}]}, {"ruleId": "scanner-75ceabeae28772ee", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/agents-list-create-delete-smoke.mjs:362"}, "properties": {"repobilityId": "a328ca9c0c79507d", "scanner": "scanner-primary", "fingerprint": "75ceabeae28772ee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/agents-list-create-delete-smoke.mjs"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-6b0484406a9d40f4", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-workspace-integrations-smoke.mjs:76"}, "properties": {"repobilityId": "2363a9879634dc82", "scanner": "scanner-primary", "fingerprint": "6b0484406a9d40f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-workspace-integrations-smoke.mjs"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-ff928ca0f43b390e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/annotation-queue-metrics-panels-smoke.mjs:732"}, "properties": {"repobilityId": "ff0c95479ad5f12d", "scanner": "scanner-primary", "fingerprint": "ff928ca0f43b390e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/annotation-queue-metrics-panels-smoke.mjs"}, "region": {"startLine": 732}}}]}, {"ruleId": "scanner-d76cc7b7eaac2bb7", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/falcon-ai-conversation-smoke.mjs:446"}, "properties": {"repobilityId": "5db5fe7fa1556155", "scanner": "scanner-primary", "fingerprint": "d76cc7b7eaac2bb7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/falcon-ai-conversation-smoke.mjs"}, "region": {"startLine": 446}}}]}, {"ruleId": "scanner-2ec0502254eb8db4", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/settings-mcp-server-smoke.mjs:55"}, "properties": {"repobilityId": "4ccb2ca1379cdc3e", "scanner": "scanner-primary", "fingerprint": "2ec0502254eb8db4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/settings-mcp-server-smoke.mjs"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-96c60efed8aac495", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/prototype-project-create-delete-smoke.mjs:344"}, "properties": {"repobilityId": "cfb6919423ce51fc", "scanner": "scanner-primary", "fingerprint": "96c60efed8aac495", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/prototype-project-create-delete-smoke.mjs"}, "region": {"startLine": 344}}}]}, {"ruleId": "scanner-0da5ff9e85e016fa", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-fallbacks-mutation-smoke.mjs:596"}, "properties": {"repobilityId": "72ab4cbcf9ff57bc", "scanner": "scanner-primary", "fingerprint": "0da5ff9e85e016fa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-fallbacks-mutation-smoke.mjs"}, "region": {"startLine": 596}}}]}, {"ruleId": "scanner-9734111c1349a041", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/scripts/api-journeys/browser/gateway-monitoring-smoke.mjs:562"}, "properties": {"repobilityId": "f08bc3ba256937ac", "scanner": "scanner-primary", "fingerprint": "9734111c1349a041", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/api-journeys/browser/gateway-monitoring-smoke.mjs"}, "region": {"startLine": 562}}}]}, {"ruleId": "scanner-8a6ccd01adb69f2c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/context/jwt/utils.js:40"}, "properties": {"repobilityId": "434aa807e490e0c4", "scanner": "scanner-primary", "fingerprint": "8a6ccd01adb69f2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/auth/context/jwt/utils.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-ccbc64e56231ab1a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/context/jwt/auth-provider.jsx:219"}, "properties": {"repobilityId": "593bf9e227ecc2ea", "scanner": "scanner-primary", "fingerprint": "ccbc64e56231ab1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/auth/context/jwt/auth-provider.jsx"}, "region": {"startLine": 219}}}]}, {"ruleId": "scanner-4d28b1fc7630e115", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/auth/guard/auth-guard.jsx:64"}, "properties": {"repobilityId": "8bba589faf788cd5", "scanner": "scanner-primary", "fingerprint": "4d28b1fc7630e115", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/auth/guard/auth-guard.jsx"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-ffd16d04cd2f2fa1", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/utils/axios.js:183"}, "properties": {"repobilityId": "a492180ea96c46f6", "scanner": "scanner-primary", "fingerprint": "ffd16d04cd2f2fa1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/utils/axios.js"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-1822b47adb7b3ed7", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/components/traceDetail/SpanDetailPane.jsx:120"}, "properties": {"repobilityId": "78f3b745e3ef6d62", "scanner": "scanner-primary", "fingerprint": "1822b47adb7b3ed7", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/traceDetail/SpanDetailPane.jsx"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-c66af49d30717fb7", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/pages/SOSLoginPage.jsx:20"}, "properties": {"repobilityId": "e5fbb0f758c34208", "scanner": "scanner-primary", "fingerprint": "c66af49d30717fb7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/SOSLoginPage.jsx"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-00eaaf5b47b76afc", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/sections/prompt/PromptBox/InputPromptBoxV3.jsx:45"}, "properties": {"repobilityId": "cf7de9c0db91aa33", "scanner": "scanner-primary", "fingerprint": "00eaaf5b47b76afc", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/prompt/PromptBox/InputPromptBoxV3.jsx"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-977a75e6192d345b", "level": "error", "message": {"text": "Insecure pattern 'python_os_system' in frontend/src/sections/evals/components/CodeEvalEditor.jsx:180"}, "properties": {"repobilityId": "47d689009b45cfae", "scanner": "scanner-primary", "fingerprint": "977a75e6192d345b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "python_os_system"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/evals/components/CodeEvalEditor.jsx"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-1275bb76e6fcec49", "level": "warning", "message": {"text": "Possible secret in frontend/src/hooks/use-mocked-user.js"}, "properties": {"repobilityId": "8e04767c5dbb29e3", "scanner": "scanner-primary", "fingerprint": "1275bb76e6fcec49", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/use-mocked-user.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-6482890cdb2876ef", "level": "warning", "message": {"text": "Possible secret in futureagi/conftest.py"}, "properties": {"repobilityId": "58c9dd14e97aa672", "scanner": "scanner-primary", "fingerprint": "6482890cdb2876ef", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/conftest.py"}, "region": {"startLine": 817}}}]}, {"ruleId": "scanner-ce2cea8a363ed516", "level": "warning", "message": {"text": "Possible secret in futureagi/agent_playground/tests/conftest.py"}, "properties": {"repobilityId": "13dafa37d46c0177", "scanner": "scanner-primary", "fingerprint": "ce2cea8a363ed516", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agent_playground/tests/conftest.py"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-d0f07c077549972f", "level": "warning", "message": {"text": "Possible secret in futureagi/scripts/property_catalog_oss/bootstrap_postgres.sh"}, "properties": {"repobilityId": "c74f59c17a4e2844", "scanner": "scanner-primary", "fingerprint": "d0f07c077549972f", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/scripts/property_catalog_oss/bootstrap_postgres.sh"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-3e4f1cc7a2fac49f", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in futureagi/accounts/gcp_marketplace_utils.py:85"}, "properties": {"repobilityId": "4d7e4e321a7a57c6", "scanner": "scanner-primary", "fingerprint": "3e4f1cc7a2fac49f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/gcp_marketplace_utils.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-97cacb362324a5fc", "level": "warning", "message": {"text": "Possible secret in futureagi/tfc/temporal/agent_playground/tests/conftest.py"}, "properties": {"repobilityId": "95617692990d7a1c", "scanner": "scanner-primary", "fingerprint": "97cacb362324a5fc", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/temporal/agent_playground/tests/conftest.py"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-6966d3f6d6fb5b13", "level": "warning", "message": {"text": "Possible secret in futureagi/tfc/temporal/experiments/tests/conftest.py"}, "properties": {"repobilityId": "4df7a534cd4c0acc", "scanner": "scanner-primary", "fingerprint": "6966d3f6d6fb5b13", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/temporal/experiments/tests/conftest.py"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-3a00ce3ff2d2eebc", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py:257"}, "properties": {"repobilityId": "867905361a06d673", "scanner": "scanner-primary", "fingerprint": "3a00ce3ff2d2eebc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/fi_utils/restricted_code_execution.py"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-36520a0f6bfd2a7b", "level": "warning", "message": {"text": "Possible secret in futureagi/tracer/tests/integration/conftest.py"}, "properties": {"repobilityId": "ecf194da19b9161a", "scanner": "scanner-primary", "fingerprint": "36520a0f6bfd2a7b", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/tests/integration/conftest.py"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-0118bdc73b9d08a8", "level": "warning", "message": {"text": "Possible secret in futureagi/tracer/tests/integration/_seed.py"}, "properties": {"repobilityId": "29bdc56c660125d0", "scanner": "scanner-primary", "fingerprint": "0118bdc73b9d08a8", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/tests/integration/_seed.py"}, "region": {"startLine": 661}}}]}, {"ruleId": "scanner-bbccb25ef9ea4477", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in futureagi/ee/falcon_ai/builtin_skills/fix-with-falcon.yaml:142"}, "properties": {"repobilityId": "d2c44e4f237d4046", "scanner": "scanner-primary", "fingerprint": "bbccb25ef9ea4477", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/falcon_ai/builtin_skills/fix-with-falcon.yaml"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-0de6dc1f058f77e9", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in agentcc-gateway/internal/middleware/cors.go:100"}, "properties": {"repobilityId": "827fd6b52cbac2f0", "scanner": "scanner-primary", "fingerprint": "0de6dc1f058f77e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/middleware/cors.go"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-8e7271110d5e31c3", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in agentcc-gateway/internal/guardrails/expression/expression.go:55"}, "properties": {"repobilityId": "dd65b76169c7b145", "scanner": "scanner-primary", "fingerprint": "8e7271110d5e31c3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/guardrails/expression/expression.go"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-e44de735fae4f837", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in agentcc-gateway/internal/guardrails/mcpsec/toolguard_test.go:81"}, "properties": {"repobilityId": "51d438177f4a314d", "scanner": "scanner-primary", "fingerprint": "e44de735fae4f837", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/guardrails/mcpsec/toolguard_test.go"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-dff04bbb5f03a528", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in agentcc-gateway/internal/guardrails/mcpsec/mcpsec_test.go:214"}, "properties": {"repobilityId": "0a7731b42ed67560", "scanner": "scanner-primary", "fingerprint": "dff04bbb5f03a528", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/guardrails/mcpsec/mcpsec_test.go"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-23d8d46b7a1ab200", "level": "error", "message": {"text": "Possible secret in agentcc-gateway/internal/guardrails/secrets/secrets_test.go"}, "properties": {"repobilityId": "48252827aa77ae75", "scanner": "scanner-primary", "fingerprint": "23d8d46b7a1ab200", "layer": "security", "severity": "critical", "confidence": 0.99, "tags": ["secrets", "github_token", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/guardrails/secrets/secrets_test.go"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-3bedb1654eef4748", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in agentcc-gateway/internal/cache/backend_azblob.go:197"}, "properties": {"repobilityId": "16e90ddfd100a19b", "scanner": "scanner-primary", "fingerprint": "3bedb1654eef4748", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agentcc-gateway/internal/cache/backend_azblob.go"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-7c9e34148a972152", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in e2e/flows/observe/graph-metric-scoping.spec.ts:141"}, "properties": {"repobilityId": "9e85e425ae862526", "scanner": "scanner-primary", "fingerprint": "7c9e34148a972152", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/flows/observe/graph-metric-scoping.spec.ts"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-85672b8ac5b40d0c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in e2e/lib/auth.ts:7"}, "properties": {"repobilityId": "2418a72d15dc4e77", "scanner": "scanner-primary", "fingerprint": "85672b8ac5b40d0c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "e2e/lib/auth.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-c8b4acf461c6fdb0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "82c1ee91fdb673fd", "scanner": "scanner-primary", "fingerprint": "c8b4acf461c6fdb0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/.github/workflows/auto-approve-hotfix.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-478a3bc374f5d2bb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9f937869435deb56", "scanner": "scanner-primary", "fingerprint": "478a3bc374f5d2bb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/.github/workflows/auto-approve-hotfix.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-91ba379b9c200873", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b62375e9be9fc7a", "scanner": "scanner-primary", "fingerprint": "91ba379b9c200873", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-dev-cdn.yaml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-04efab929fdad8b3", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4c59e63373e053c", "scanner": "scanner-primary", "fingerprint": "04efab929fdad8b3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agentcc-gateway-ci.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-cbe310f193a6df9f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "573212e145c44806", "scanner": "scanner-primary", "fingerprint": "cbe310f193a6df9f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-please.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0c3b23d8a43a55e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f8c3494304345c4", "scanner": "scanner-primary", "fingerprint": "b0c3b23d8a43a55e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-images.yml"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-86b175677347f077", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3a5ea208e8f272b", "scanner": "scanner-primary", "fingerprint": "86b175677347f077", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/api-contracts.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-b0bc52d7c3302767", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b6e0280572c3892", "scanner": "scanner-primary", "fingerprint": "b0bc52d7c3302767", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-deploy-us2.yaml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-2869f9f5a62a937e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a343c71aa98eff3c", "scanner": "scanner-primary", "fingerprint": "2869f9f5a62a937e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sdk-compatibility.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-94555377f6661d3b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2d03e1dfa6ea52b3", "scanner": "scanner-primary", "fingerprint": "94555377f6661d3b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-main.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-0a2fe1ff681f384d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "63df701f6d49b2dc", "scanner": "scanner-primary", "fingerprint": "0a2fe1ff681f384d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/admission.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-4f26d035c99748ab", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2526d36eb2a86b1", "scanner": "scanner-primary", "fingerprint": "4f26d035c99748ab", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/base-image-publish.yml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-b7a64e431e659190", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ffdeea46504b901", "scanner": "scanner-primary", "fingerprint": "b7a64e431e659190", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/linear-release-done.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-975f27e3804c7491", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "424b664d3603032a", "scanner": "scanner-primary", "fingerprint": "975f27e3804c7491", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/backend-ci.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-efffd648a33c5dc1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "16bc3fbfa06e0fa7", "scanner": "scanner-primary", "fingerprint": "efffd648a33c5dc1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-deploy-eu.yaml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-dfda159126dca791", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fea4f9a56be666a5", "scanner": "scanner-primary", "fingerprint": "dfda159126dca791", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-prod-deploy.yaml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-ce0ddc37b6e997f9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ae3aee0da6a0c71", "scanner": "scanner-primary", "fingerprint": "ce0ddc37b6e997f9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-develop.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-fc122733f7b52e90", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e1034bde1e46aa51", "scanner": "scanner-primary", "fingerprint": "fc122733f7b52e90", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-feature.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-8355bdc1ce844cbb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4fbc5393dcad886c", "scanner": "scanner-primary", "fingerprint": "8355bdc1ce844cbb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-backend.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-8be3e52b87df4e5c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f065e62b056198f0", "scanner": "scanner-primary", "fingerprint": "8be3e52b87df4e5c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh-disposable-domains.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-0921e7e28a7b390c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7e9cd4812a2696ea", "scanner": "scanner-primary", "fingerprint": "0921e7e28a7b390c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-ci.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-8febc47d818b60c4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "23003b88e4091d9d", "scanner": "scanner-primary", "fingerprint": "8febc47d818b60c4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/e2e-ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c853bff7865db66", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab22cd74ff517783", "scanner": "scanner-primary", "fingerprint": "5c853bff7865db66", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/frontend-auto-approve-hotfix.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da29cd913cf8a314", "level": "note", "message": {"text": "Very large file: fi-collector/pkg/propertycatalog/checkpoint_loader.go (1795 lines)"}, "properties": {"repobilityId": "e1176617be5580af", "scanner": "scanner-primary", "fingerprint": "da29cd913cf8a314", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dfbbc2ebeff32f33", "level": "note", "message": {"text": "Very large file: fi-collector/pkg/propertycatalog/checkpoint_loader_test.go (1506 lines)"}, "properties": {"repobilityId": "d95dea8cc6bbc636", "scanner": "scanner-primary", "fingerprint": "dfbbc2ebeff32f33", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-67cd21bd86d49c74", "level": "note", "message": {"text": "Very large file: frontend/scripts/test-annotation-rules.mjs (2761 lines)"}, "properties": {"repobilityId": "c4cf90218b48dd25", "scanner": "scanner-primary", "fingerprint": "67cd21bd86d49c74", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dacd933048e4f3ca", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/journeys/public-api.mjs (6548 lines)"}, "properties": {"repobilityId": "05b22d7b7d87c773", "scanner": "scanner-primary", "fingerprint": "dacd933048e4f3ca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f7727218cc938a68", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/journeys/observe-filters.mjs (13658 lines)"}, "properties": {"repobilityId": "eebced2ff68127cb", "scanner": "scanner-primary", "fingerprint": "f7727218cc938a68", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-69acde7748dc549e", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/journeys/agent-playground.mjs (2759 lines)"}, "properties": {"repobilityId": "df9ae89da812419e", "scanner": "scanner-primary", "fingerprint": "69acde7748dc549e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fc191d84b9f2d407", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/journeys/app-core.mjs (20088 lines)"}, "properties": {"repobilityId": "416c36e4c6f1bca5", "scanner": "scanner-primary", "fingerprint": "fc191d84b9f2d407", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-269853eabd7a00c9", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs (14761 lines)"}, "properties": {"repobilityId": "181e13f191a64c8b", "scanner": "scanner-primary", "fingerprint": "269853eabd7a00c9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ef1a3830267db399", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/journeys/annotation-queues.mjs (16139 lines)"}, "properties": {"repobilityId": "787b011cba20155c", "scanner": "scanner-primary", "fingerprint": "ef1a3830267db399", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-39a6e26e79d7e861", "level": "note", "message": {"text": "Very large file: frontend/scripts/api-journeys/browser/agents-playground-smoke.mjs (1884 lines)"}, "properties": {"repobilityId": "d8c65271961e9c32", "scanner": "scanner-primary", "fingerprint": "39a6e26e79d7e861", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-13a6290421da8e3c", "level": "note", "message": {"text": "Very large file: frontend/src/generated/api-contracts/api.schemas.ts (32500 lines)"}, "properties": {"repobilityId": "591b2310d7ac7df4", "scanner": "scanner-primary", "fingerprint": "13a6290421da8e3c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c64385dd6ba6ed5e", "level": "note", "message": {"text": "Very large file: frontend/src/api/annotation-queues/annotation-queues.js (1973 lines)"}, "properties": {"repobilityId": "248debd6a47e0acb", "scanner": "scanner-primary", "fingerprint": "c64385dd6ba6ed5e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-613b1d504d03c4be", "level": "note", "message": {"text": "Very large file: frontend/src/api/annotation-queues/__tests__/annotation-queues.test.js (2183 lines)"}, "properties": {"repobilityId": "85ede0d9c86bb46f", "scanner": "scanner-primary", "fingerprint": "613b1d504d03c4be", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-692fefa100a046c3", "level": "note", "message": {"text": "Very large file: frontend/src/api/contracts/api-surface.generated.js (2406 lines)"}, "properties": {"repobilityId": "01b5dc138f58259e", "scanner": "scanner-primary", "fingerprint": "692fefa100a046c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4e621280437b29d7", "level": "note", "message": {"text": "Very large file: frontend/src/utils/axios.js (2193 lines)"}, "properties": {"repobilityId": "9aab7b11f12b8b42", "scanner": "scanner-primary", "fingerprint": "4e621280437b29d7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-005c24c972255991", "level": "note", "message": {"text": "Very large file: frontend/src/components/filter-panel/FilterPanel.jsx (2165 lines)"}, "properties": {"repobilityId": "9e2af82ada477c55", "scanner": "scanner-primary", "fingerprint": "005c24c972255991", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aa917aee2c7a5cf2", "level": "note", "message": {"text": "Very large file: frontend/src/components/VoiceDetailDrawerV2/PathAnalysisView.jsx (1667 lines)"}, "properties": {"repobilityId": "9aaa955b7c9d8d21", "scanner": "scanner-primary", "fingerprint": "aa917aee2c7a5cf2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c6099f4d1b97753e", "level": "note", "message": {"text": "Very large file: frontend/src/components/traceDetail/SpanDetailPane.jsx (2798 lines)"}, "properties": {"repobilityId": "d859e91c2c0720fd", "scanner": "scanner-primary", "fingerprint": "c6099f4d1b97753e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee44dc94ba05f917", "level": "note", "message": {"text": "Very large file: frontend/src/components/traceDetail/TraceDetailDrawerV2.jsx (1555 lines)"}, "properties": {"repobilityId": "792d5d694b58ecc4", "scanner": "scanner-primary", "fingerprint": "ee44dc94ba05f917", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-325827a0a9e4bf09", "level": "note", "message": {"text": "Very large file: frontend/src/components/three/umap.jsx (2194 lines)"}, "properties": {"repobilityId": "083b2fac513f7577", "scanner": "scanner-primary", "fingerprint": "325827a0a9e4bf09", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5c0423a38dfc666f", "level": "note", "message": {"text": "Very large file: frontend/src/components/run-tests/CreateRunTestPage.jsx (2389 lines)"}, "properties": {"repobilityId": "3340266a398c8228", "scanner": "scanner-primary", "fingerprint": "5c0423a38dfc666f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eecc5fb6383cee43", "level": "note", "message": {"text": "Very large file: frontend/src/pages/dashboard/error-feed/components/AnalyzeTab.jsx (1737 lines)"}, "properties": {"repobilityId": "ae9707859d44633f", "scanner": "scanner-primary", "fingerprint": "eecc5fb6383cee43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bd95bbf59a812764", "level": "note", "message": {"text": "Very large file: frontend/src/pages/dashboard/error-feed/components/OverviewTab.jsx (2806 lines)"}, "properties": {"repobilityId": "7cfb2d7f19f43a12", "scanner": "scanner-primary", "fingerprint": "bd95bbf59a812764", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eae3f32effaee181", "level": "note", "message": {"text": "Very large file: frontend/src/pages/dashboard/harness/HarnessCreate.jsx (1635 lines)"}, "properties": {"repobilityId": "013201bdf48fe594", "scanner": "scanner-primary", "fingerprint": "eae3f32effaee181", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-db209e5514aa318d", "level": "note", "message": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/TraceFilterPanel.jsx (5406 lines)"}, "properties": {"repobilityId": "039b9b42f125151f", "scanner": "scanner-primary", "fingerprint": "db209e5514aa318d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-98e1a68efff6414f", "level": "note", "message": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx (5307 lines)"}, "properties": {"repobilityId": "b83db8ef7b34efb9", "scanner": "scanner-primary", "fingerprint": "98e1a68efff6414f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-34e12c14c377988f", "level": "note", "message": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/__tests__/listCursorPagination.test.js (1789 lines)"}, "properties": {"repobilityId": "37aaa6218355fa5f", "scanner": "scanner-primary", "fingerprint": "34e12c14c377988f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9f52e82d01115f69", "level": "note", "message": {"text": "Very large file: frontend/src/sections/projects/LLMTracing/__tests__/TraceFilterPanel.test.jsx (6891 lines)"}, "properties": {"repobilityId": "4d0473d2f87ba73e", "scanner": "scanner-primary", "fingerprint": "9f52e82d01115f69", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-134545916828176e", "level": "note", "message": {"text": "Very large file: frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx (1616 lines)"}, "properties": {"repobilityId": "afeab1f2282921cb", "scanner": "scanner-primary", "fingerprint": "134545916828176e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-234f2930eab32af2", "level": "note", "message": {"text": "Very large file: frontend/src/sections/common/EvalPicker/EvalPickerConfigFull.jsx (2311 lines)"}, "properties": {"repobilityId": "f919a1c33f5d16c3", "scanner": "scanner-primary", "fingerprint": "234f2930eab32af2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2fc0ca07d95eb88f", "level": "note", "message": {"text": "Very large file: frontend/src/sections/common/EvalPicker/EvalPickerCreateNew.jsx (1495 lines)"}, "properties": {"repobilityId": "ab6623a64571ae01", "scanner": "scanner-primary", "fingerprint": "2fc0ca07d95eb88f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b428b222f16989bc", "level": "note", "message": {"text": "Very large file: frontend/src/sections/develop-detail/RunPrompt/RunPrompt.jsx (2421 lines)"}, "properties": {"repobilityId": "8efb0a33fb415c9d", "scanner": "scanner-primary", "fingerprint": "b428b222f16989bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-298d63c0b30b402c", "level": "note", "message": {"text": "Very large file: frontend/src/sections/develop-detail/DataTab/DatapointDrawerV2/DatapointDrawerV2.jsx (1729 lines)"}, "properties": {"repobilityId": "a92f1af5cd6d98cd", "scanner": "scanner-primary", "fingerprint": "298d63c0b30b402c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c27cfb2d02007a53", "level": "note", "message": {"text": "Very large file: frontend/src/sections/dashboards/WidgetEditorView.jsx (8014 lines)"}, "properties": {"repobilityId": "ada70c4194ce74d0", "scanner": "scanner-primary", "fingerprint": "c27cfb2d02007a53", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f849ec0d09dd8506", "level": "note", "message": {"text": "Very large file: frontend/src/sections/dashboards/DashboardDetailView.jsx (1808 lines)"}, "properties": {"repobilityId": "f31451a1129e0782", "scanner": "scanner-primary", "fingerprint": "f849ec0d09dd8506", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4104c4e246198d65", "level": "note", "message": {"text": "Very large file: frontend/src/sections/dashboards/WidgetChart.jsx (1562 lines)"}, "properties": {"repobilityId": "f21cd7c24bc6371f", "scanner": "scanner-primary", "fingerprint": "4104c4e246198d65", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3dbd166ae6b93b0d", "level": "note", "message": {"text": "Very large file: frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx (1741 lines)"}, "properties": {"repobilityId": "ae26a07c9f634bee", "scanner": "scanner-primary", "fingerprint": "3dbd166ae6b93b0d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5ece8a46def930a8", "level": "note", "message": {"text": "Very large file: frontend/src/sections/tasks/components/TaskLivePreview.jsx (1805 lines)"}, "properties": {"repobilityId": "8b58d96e955a62a5", "scanner": "scanner-primary", "fingerprint": "5ece8a46def930a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-60d7c613798317d9", "level": "note", "message": {"text": "Very large file: frontend/src/sections/tasks/components/__tests__/TaskLivePreview.cursor.test.jsx (2284 lines)"}, "properties": {"repobilityId": "283a577744440161", "scanner": "scanner-primary", "fingerprint": "60d7c613798317d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7acb38100b12f9c0", "level": "note", "message": {"text": "Very large file: frontend/src/sections/annotations/queues/__tests__/annotate-components.test.jsx (3431 lines)"}, "properties": {"repobilityId": "66b04163d8f624a6", "scanner": "scanner-primary", "fingerprint": "7acb38100b12f9c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f4677c4c5a0a8ceb", "level": "note", "message": {"text": "Very large file: frontend/src/sections/annotations/queues/annotate/annotation-comparison-panel.jsx (2202 lines)"}, "properties": {"repobilityId": "20f7eea23387b619", "scanner": "scanner-primary", "fingerprint": "f4677c4c5a0a8ceb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-597e7b1c796c0aba", "level": "note", "message": {"text": "Very large file: frontend/src/sections/annotations/queues/annotate/discussion-panel.jsx (2783 lines)"}, "properties": {"repobilityId": "96ea39dd78df389a", "scanner": "scanner-primary", "fingerprint": "597e7b1c796c0aba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-32e4240d97a5627b", "level": "note", "message": {"text": "Very large file: frontend/src/sections/annotations/queues/annotate/annotate-workspace-view.jsx (1831 lines)"}, "properties": {"repobilityId": "8707bbfd76cdd1b9", "scanner": "scanner-primary", "fingerprint": "32e4240d97a5627b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-982975cfe7b31d22", "level": "note", "message": {"text": "Very large file: frontend/src/sections/annotations/queues/items/add-items-dialog.jsx (5046 lines)"}, "properties": {"repobilityId": "743712e4d1cb1b6e", "scanner": "scanner-primary", "fingerprint": "982975cfe7b31d22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fa4fc455a627ba27", "level": "note", "message": {"text": "Very large file: frontend/src/sections/falcon-ai/components/CustomizePanel.jsx (2555 lines)"}, "properties": {"repobilityId": "7019eba0bc2a1674", "scanner": "scanner-primary", "fingerprint": "fa4fc455a627ba27", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7f873b03a133e0d6", "level": "note", "message": {"text": "Very large file: frontend/src/sections/gateway/settings/RoutingConfigTab.jsx (1796 lines)"}, "properties": {"repobilityId": "2d3970327c1f8818", "scanner": "scanner-primary", "fingerprint": "7f873b03a133e0d6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0d5352893f13b4a7", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/TracingTestMode.jsx (2538 lines)"}, "properties": {"repobilityId": "7c519a054bc0ba57", "scanner": "scanner-primary", "fingerprint": "0d5352893f13b4a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-623b7cb36b4d862f", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/EvalCreatePage.jsx (1553 lines)"}, "properties": {"repobilityId": "125e9bc50c34cbea", "scanner": "scanner-primary", "fingerprint": "623b7cb36b4d862f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-92f8077bbd5d8e0b", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/ModelSelector.jsx (1966 lines)"}, "properties": {"repobilityId": "5cdc513ebfa84368", "scanner": "scanner-primary", "fingerprint": "92f8077bbd5d8e0b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cf4a8c9db0bf033a", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/TestPlayground.jsx (1967 lines)"}, "properties": {"repobilityId": "92093e3d049bf0ac", "scanner": "scanner-primary", "fingerprint": "cf4a8c9db0bf033a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7c69522a94abc94b", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/EvalDetailPage.jsx (2163 lines)"}, "properties": {"repobilityId": "3edd4fcbb4581eef", "scanner": "scanner-primary", "fingerprint": "7c69522a94abc94b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-36da7cd813587dc9", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/DatasetTestMode.jsx (1967 lines)"}, "properties": {"repobilityId": "43c2b48104c67fee", "scanner": "scanner-primary", "fingerprint": "36da7cd813587dc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7894299c3149d4ab", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/EvalGroundTruthTab.jsx (2175 lines)"}, "properties": {"repobilityId": "3b83d4dbb63c5c83", "scanner": "scanner-primary", "fingerprint": "7894299c3149d4ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9bf20396632d249c", "level": "note", "message": {"text": "Very large file: frontend/src/sections/evals/components/SimulationTestMode.jsx (2329 lines)"}, "properties": {"repobilityId": "e8821c79c48ccc2b", "scanner": "scanner-primary", "fingerprint": "9bf20396632d249c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a4e153b1a510a08", "level": "note", "message": {"text": "Very large file: frontend/src/hooks/__tests__/useDashboards.test.js (2075 lines)"}, "properties": {"repobilityId": "c8c42ff28b23eded", "scanner": "scanner-primary", "fingerprint": "6a4e153b1a510a08", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-103ac4a7a2cabd8a", "level": "note", "message": {"text": "Very large file: futureagi/agent_playground/tests/serializers/test_node_serializers.py (1718 lines)"}, "properties": {"repobilityId": "1d280e043a6a2d2e", "scanner": "scanner-primary", "fingerprint": "103ac4a7a2cabd8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d4be82a8e731362", "level": "note", "message": {"text": "Very large file: futureagi/agent_playground/tests/services/test_node_crud.py (4414 lines)"}, "properties": {"repobilityId": "e608315681e1caef", "scanner": "scanner-primary", "fingerprint": "4d4be82a8e731362", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c76e1fb707741779", "level": "note", "message": {"text": "Very large file: futureagi/agent_playground/tests/views/test_graph_views.py (2272 lines)"}, "properties": {"repobilityId": "4f781167348788d0", "scanner": "scanner-primary", "fingerprint": "c76e1fb707741779", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9ff7e603a32b02c9", "level": "note", "message": {"text": "Very large file: futureagi/agent_playground/tests/views/test_node_views.py (1709 lines)"}, "properties": {"repobilityId": "8b1a07fe15c0bb4e", "scanner": "scanner-primary", "fingerprint": "9ff7e603a32b02c9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8d92bb0c3c99fbe9", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_custom_models_api.py (1706 lines)"}, "properties": {"repobilityId": "484a4f05fb78ff3a", "scanner": "scanner-primary", "fingerprint": "8d92bb0c3c99fbe9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7b3df9e81a0353c1", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_develop_annotations_api.py (1651 lines)"}, "properties": {"repobilityId": "136883e544066a90", "scanner": "scanner-primary", "fingerprint": "7b3df9e81a0353c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1f5feb4c9ad321f7", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_experiment_api.py (1943 lines)"}, "properties": {"repobilityId": "f20fda8479a0c120", "scanner": "scanner-primary", "fingerprint": "1f5feb4c9ad321f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-77a917ceabf9ae1a", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_voice_annotation_regressions_e2e.py (2860 lines)"}, "properties": {"repobilityId": "2a2328d164767ee1", "scanner": "scanner-primary", "fingerprint": "77a917ceabf9ae1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2fa34ac3f2e68e49", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_workflow_api.py (7062 lines)"}, "properties": {"repobilityId": "7aa3ddd159dd6c55", "scanner": "scanner-primary", "fingerprint": "2fa34ac3f2e68e49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-226b40476921100b", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_e2e_gaps.py (1581 lines)"}, "properties": {"repobilityId": "f8d97aee6ae104b7", "scanner": "scanner-primary", "fingerprint": "226b40476921100b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e2c6d55b517c5499", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_team_a_annotations_full_matrix.py (3223 lines)"}, "properties": {"repobilityId": "0fd1f0699abc476e", "scanner": "scanner-primary", "fingerprint": "e2c6d55b517c5499", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1052c2057ef23e75", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_scores_api.py (1658 lines)"}, "properties": {"repobilityId": "9ae8035f43c5d409", "scanner": "scanner-primary", "fingerprint": "1052c2057ef23e75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e5ce9a8ab05f7c5b", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_eval_runner.py (1696 lines)"}, "properties": {"repobilityId": "bced0c24a6c1fcf6", "scanner": "scanner-primary", "fingerprint": "e5ce9a8ab05f7c5b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2a253c65ae3d62de", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_evaluation_api.py (2595 lines)"}, "properties": {"repobilityId": "f2883fa289f43635", "scanner": "scanner-primary", "fingerprint": "2a253c65ae3d62de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-810af3fa5f77eb2e", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_queues_api.py (1413 lines)"}, "properties": {"repobilityId": "9408032d969faa0d", "scanner": "scanner-primary", "fingerprint": "810af3fa5f77eb2e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aa18ff3a58eceda0", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_experiment_v2_feedback.py (1519 lines)"}, "properties": {"repobilityId": "bf53b8cc65a62c73", "scanner": "scanner-primary", "fingerprint": "aa18ff3a58eceda0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0577642302fbb129", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_ch25_annotation_collector_source_resolution.py (1304 lines)"}, "properties": {"repobilityId": "cdf1abf6d269b8a7", "scanner": "scanner-primary", "fingerprint": "0577642302fbb129", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-436fb47c1df87f44", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_user_evaluation_tasks.py (1620 lines)"}, "properties": {"repobilityId": "a72e4ecb32074ed6", "scanner": "scanner-primary", "fingerprint": "436fb47c1df87f44", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1ee3d2b4fbf7b8f1", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_eval_versioning.py (1990 lines)"}, "properties": {"repobilityId": "866aa07078547f58", "scanner": "scanner-primary", "fingerprint": "1ee3d2b4fbf7b8f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cb4f3c25add4e513", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_automation_rules_e2e.py (3438 lines)"}, "properties": {"repobilityId": "634a092fdd975cd6", "scanner": "scanner-primary", "fingerprint": "cb4f3c25add4e513", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6b9da37c0046a96c", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_dataset_bulk_add_items_filter.py (1827 lines)"}, "properties": {"repobilityId": "91f4df642d2e1efb", "scanner": "scanner-primary", "fingerprint": "6b9da37c0046a96c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d10b46fa6958e083", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_advanced_api.py (1562 lines)"}, "properties": {"repobilityId": "31c08d057444f983", "scanner": "scanner-primary", "fingerprint": "d10b46fa6958e083", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bd59f18abf79ca17", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_annotation_queues_api_errors.py (1770 lines)"}, "properties": {"repobilityId": "3d22dd60d8a7c754", "scanner": "scanner-primary", "fingerprint": "bd59f18abf79ca17", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-738b7358a81ba6c9", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_dataset_dynamic_columns.py (1354 lines)"}, "properties": {"repobilityId": "5b39895e8464573a", "scanner": "scanner-primary", "fingerprint": "738b7358a81ba6c9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1d7d18c268d8c9e0", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tests/test_run_prompt_api.py (3655 lines)"}, "properties": {"repobilityId": "9bc3faf5c574e415", "scanner": "scanner-primary", "fingerprint": "1d7d18c268d8c9e0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a5a97a4f1d0ccd1", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/utils/SQL_queries.py (1573 lines)"}, "properties": {"repobilityId": "2d4d239d7be87a1e", "scanner": "scanner-primary", "fingerprint": "6a5a97a4f1d0ccd1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fd036dcf42e6f105", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/utils/evals.py (3216 lines)"}, "properties": {"repobilityId": "5818f919d099249e", "scanner": "scanner-primary", "fingerprint": "fd036dcf42e6f105", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fadc2f5362b6e4a6", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/utils/annotation_queue_helpers.py (3631 lines)"}, "properties": {"repobilityId": "17a81027fb19f136", "scanner": "scanner-primary", "fingerprint": "fadc2f5362b6e4a6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cf1552074339731b", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/tasks/user_evaluation.py (1473 lines)"}, "properties": {"repobilityId": "1920038184b3c309", "scanner": "scanner-primary", "fingerprint": "cf1552074339731b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d965365f8a21b100", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/serializers/annotation_queues.py (2009 lines)"}, "properties": {"repobilityId": "4d91103f5dbade38", "scanner": "scanner-primary", "fingerprint": "d965365f8a21b100", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b34fda2629f41110", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/serializers/contracts.py (3370 lines)"}, "properties": {"repobilityId": "2e3c92fead4be099", "scanner": "scanner-primary", "fingerprint": "b34fda2629f41110", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-126d04b7c8835c84", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/services/bulk_selection.py (1815 lines)"}, "properties": {"repobilityId": "87fb975457aef14e", "scanner": "scanner-primary", "fingerprint": "126d04b7c8835c84", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-609b5184adc7e941", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/services/dataset_service.py (1678 lines)"}, "properties": {"repobilityId": "21880a6465bbca9a", "scanner": "scanner-primary", "fingerprint": "609b5184adc7e941", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3d6e16b7a23215ab", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/migrations/0001_initial.py (883 lines)"}, "properties": {"repobilityId": "4a979f6d962518c6", "scanner": "scanner-primary", "fingerprint": "3d6e16b7a23215ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8e600def0428138d", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/experiments.py (6376 lines)"}, "properties": {"repobilityId": "cc4683e64989eab8", "scanner": "scanner-primary", "fingerprint": "8e600def0428138d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2775cfd9bab2ffa6", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/annotation_queues.py (8295 lines)"}, "properties": {"repobilityId": "2a8db8cc031ad0b4", "scanner": "scanner-primary", "fingerprint": "2775cfd9bab2ffa6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-55274c38a8d95c08", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/optimize_dataset.py (1695 lines)"}, "properties": {"repobilityId": "578c6836b8ae5fad", "scanner": "scanner-primary", "fingerprint": "55274c38a8d95c08", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2ca00fab9f210f8c", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/eval_runner.py (3643 lines)"}, "properties": {"repobilityId": "801598cc74fa898f", "scanner": "scanner-primary", "fingerprint": "2ca00fab9f210f8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4ea59c9849ddff87", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/experiment_runner.py (2053 lines)"}, "properties": {"repobilityId": "28f3e1e101f9dad2", "scanner": "scanner-primary", "fingerprint": "4ea59c9849ddff87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c37d5f328149ed87", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/ai_filter.py (2113 lines)"}, "properties": {"repobilityId": "262e1415df6c6be6", "scanner": "scanner-primary", "fingerprint": "c37d5f328149ed87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-570c2ee88ae65ed4", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/dynamic_columns.py (3579 lines)"}, "properties": {"repobilityId": "5fbe07cb64df0c9e", "scanner": "scanner-primary", "fingerprint": "570c2ee88ae65ed4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ba327e4396d62c29", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/run_prompt.py (2869 lines)"}, "properties": {"repobilityId": "0468c31c6e16f538", "scanner": "scanner-primary", "fingerprint": "ba327e4396d62c29", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-84042cc0512c4f9a", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/develop_annotations.py (2291 lines)"}, "properties": {"repobilityId": "d273d8178f023af3", "scanner": "scanner-primary", "fingerprint": "84042cc0512c4f9a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-395376099e04cd91", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/prompt_template.py (4487 lines)"}, "properties": {"repobilityId": "7902a95eeb3a99da", "scanner": "scanner-primary", "fingerprint": "395376099e04cd91", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ce3a9e560d64d9c7", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/develop_dataset.py (16889 lines)"}, "properties": {"repobilityId": "b30f5aa668ac768f", "scanner": "scanner-primary", "fingerprint": "ce3a9e560d64d9c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-271135db8c2a9538", "level": "note", "message": {"text": "Very large file: futureagi/model_hub/views/separate_evals.py (8379 lines)"}, "properties": {"repobilityId": "99b58bf7376f6999", "scanner": "scanner-primary", "fingerprint": "271135db8c2a9538", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aa7afb919be135e4", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_temporal_activities.py (2311 lines)"}, "properties": {"repobilityId": "73022645813f89f6", "scanner": "scanner-primary", "fingerprint": "aa7afb919be135e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-58d16f50f18106a4", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_e2e_prompt_simulation.py (1435 lines)"}, "properties": {"repobilityId": "ecc81962e240de57", "scanner": "scanner-primary", "fingerprint": "58d16f50f18106a4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3f113e74950ee763", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_eval_resolver_behavior.py (1465 lines)"}, "properties": {"repobilityId": "d09346e4dfcaee5c", "scanner": "scanner-primary", "fingerprint": "3f113e74950ee763", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ac1a2412ce9f4d75", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_hosted_harness_gateway.py (1740 lines)"}, "properties": {"repobilityId": "33a5b961b80b86cc", "scanner": "scanner-primary", "fingerprint": "ac1a2412ce9f4d75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6ebce91307b0ed5f", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_agent_definition_api.py (1369 lines)"}, "properties": {"repobilityId": "1ba7699ec5ae056b", "scanner": "scanner-primary", "fingerprint": "6ebce91307b0ed5f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5a8882587fd3e84f", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_chat_simulation.py (1862 lines)"}, "properties": {"repobilityId": "7e88a145ed4f77c5", "scanner": "scanner-primary", "fingerprint": "5a8882587fd3e84f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ff925364d233dc89", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_scenarios_api.py (2007 lines)"}, "properties": {"repobilityId": "4b06235edfea314d", "scanner": "scanner-primary", "fingerprint": "ff925364d233dc89", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-748b6c1de1c45ed8", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_alk_simulate_ingestion.py (6397 lines)"}, "properties": {"repobilityId": "b34ebd3963c3cc0a", "scanner": "scanner-primary", "fingerprint": "748b6c1de1c45ed8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-15960012a8c60b41", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_rerun_api.py (1668 lines)"}, "properties": {"repobilityId": "af38e4b54fc35c9a", "scanner": "scanner-primary", "fingerprint": "15960012a8c60b41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-799d2df3758f840c", "level": "note", "message": {"text": "Very large file: futureagi/simulate/tests/test_run_test_list_api.py (2296 lines)"}, "properties": {"repobilityId": "42e36bf642e8487f", "scanner": "scanner-primary", "fingerprint": "799d2df3758f840c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8d6535e0dad475f3", "level": "note", "message": {"text": "Very large file: futureagi/simulate/utils/test_execution_utils.py (1519 lines)"}, "properties": {"repobilityId": "d1c3173600cf97c3", "scanner": "scanner-primary", "fingerprint": "8d6535e0dad475f3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6847d000343c406d", "level": "note", "message": {"text": "Very large file: futureagi/simulate/temporal/activities/xl.py (1893 lines)"}, "properties": {"repobilityId": "2b1bff77f11ba071", "scanner": "scanner-primary", "fingerprint": "6847d000343c406d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bdeba1ecf319e269", "level": "note", "message": {"text": "Very large file: futureagi/simulate/serializers/test_execution.py (1889 lines)"}, "properties": {"repobilityId": "e2441ed598771b3f", "scanner": "scanner-primary", "fingerprint": "bdeba1ecf319e269", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7e89e7de2de79117", "level": "note", "message": {"text": "Very large file: futureagi/simulate/services/hosted_runner.py (1298 lines)"}, "properties": {"repobilityId": "a3637a0e7fff8bd3", "scanner": "scanner-primary", "fingerprint": "7e89e7de2de79117", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ef84aa6b5a719c9", "level": "note", "message": {"text": "Very large file: futureagi/simulate/services/alk_simulate_ingestion.py (1780 lines)"}, "properties": {"repobilityId": "2b3f8de33ed83c3e", "scanner": "scanner-primary", "fingerprint": "3ef84aa6b5a719c9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-97755f2c02ac6752", "level": "note", "message": {"text": "Very large file: futureagi/simulate/services/hosted_harness_gateway.py (3440 lines)"}, "properties": {"repobilityId": "749775ef5e840086", "scanner": "scanner-primary", "fingerprint": "97755f2c02ac6752", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1d985fcf76644981", "level": "note", "message": {"text": "Very large file: futureagi/simulate/services/test_executor.py (5740 lines)"}, "properties": {"repobilityId": "9dd45c7e04d02c06", "scanner": "scanner-primary", "fingerprint": "1d985fcf76644981", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d92ac188a6c58178", "level": "note", "message": {"text": "Very large file: futureagi/simulate/views/scenarios.py (1768 lines)"}, "properties": {"repobilityId": "6b60b9017fb5c86a", "scanner": "scanner-primary", "fingerprint": "d92ac188a6c58178", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-46c2fc3849fd8b89", "level": "note", "message": {"text": "Very large file: futureagi/simulate/views/run_test.py (8319 lines)"}, "properties": {"repobilityId": "9aad60cc85cac6b2", "scanner": "scanner-primary", "fingerprint": "46c2fc3849fd8b89", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cba8893791d1c7c6", "level": "note", "message": {"text": "Very large file: futureagi/accounts/disposable_domains.py (8741 lines)"}, "properties": {"repobilityId": "9647dd575e0bafa8", "scanner": "scanner-primary", "fingerprint": "cba8893791d1c7c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6d2386319df9e12e", "level": "note", "message": {"text": "Very large file: futureagi/accounts/user_onboard.py (4536 lines)"}, "properties": {"repobilityId": "ca48fff630d399bb", "scanner": "scanner-primary", "fingerprint": "6d2386319df9e12e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e6cb5fdfb4544a99", "level": "note", "message": {"text": "Very large file: futureagi/accounts/tests/test_org_e2e.py (1517 lines)"}, "properties": {"repobilityId": "341feb085dfa677a", "scanner": "scanner-primary", "fingerprint": "e6cb5fdfb4544a99", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-69e75e2919b9cc41", "level": "note", "message": {"text": "Very large file: futureagi/accounts/tests/test_signup.py (2308 lines)"}, "properties": {"repobilityId": "b99aacaa89f6c898", "scanner": "scanner-primary", "fingerprint": "69e75e2919b9cc41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e450361c142b062a", "level": "note", "message": {"text": "Very large file: futureagi/accounts/tests/test_e2e_role_and_removal.py (1602 lines)"}, "properties": {"repobilityId": "4726722482b73544", "scanner": "scanner-primary", "fingerprint": "e450361c142b062a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b5b472350269f13e", "level": "note", "message": {"text": "Very large file: futureagi/accounts/views/rbac_views.py (1375 lines)"}, "properties": {"repobilityId": "323572d1cc2b9043", "scanner": "scanner-primary", "fingerprint": "b5b472350269f13e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d625f574849bfe5d", "level": "note", "message": {"text": "Very large file: futureagi/accounts/views/workspace_management.py (2485 lines)"}, "properties": {"repobilityId": "7b79a8952b1c776d", "scanner": "scanner-primary", "fingerprint": "d625f574849bfe5d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-83e9f0bb87a7cb97", "level": "note", "message": {"text": "Very large file: futureagi/agentcc/tests/test_api.py (2249 lines)"}, "properties": {"repobilityId": "92c5bfdc5994d660", "scanner": "scanner-primary", "fingerprint": "83e9f0bb87a7cb97", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-25053bc6d433bc50", "level": "note", "message": {"text": "Very large file: futureagi/agentcc/views/gateway.py (1642 lines)"}, "properties": {"repobilityId": "54d13654ba93cc97", "scanner": "scanner-primary", "fingerprint": "25053bc6d433bc50", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-71bff0d4c14ddbf4", "level": "note", "message": {"text": "Very large file: futureagi/tfc/settings/settings.py (2144 lines)"}, "properties": {"repobilityId": "9f6e08fb89518da8", "scanner": "scanner-primary", "fingerprint": "71bff0d4c14ddbf4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee1cc16c8148f8b1", "level": "note", "message": {"text": "Very large file: futureagi/tfc/tests/test_model_hub_api_contract_debt.py (1682 lines)"}, "properties": {"repobilityId": "3fefad97e94712e0", "scanner": "scanner-primary", "fingerprint": "ee1cc16c8148f8b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57919b2b1bbc8cc3", "level": "note", "message": {"text": "Very large file: futureagi/tfc/utils/storage.py (2199 lines)"}, "properties": {"repobilityId": "1fe397405779e4de", "scanner": "scanner-primary", "fingerprint": "57919b2b1bbc8cc3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5db6bc0e9dbfd3ef", "level": "note", "message": {"text": "Very large file: futureagi/tfc/utils/error_codes.py (1330 lines)"}, "properties": {"repobilityId": "0271032ce4fda702", "scanner": "scanner-primary", "fingerprint": "5db6bc0e9dbfd3ef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ba515a2dfa927ca4", "level": "note", "message": {"text": "Very large file: futureagi/tfc/temporal/agent_playground/tests/test_e2e_workflow.py (1632 lines)"}, "properties": {"repobilityId": "f11091552af48ca4", "scanner": "scanner-primary", "fingerprint": "ba515a2dfa927ca4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ef4f91e7639eb130", "level": "note", "message": {"text": "Very large file: futureagi/tfc/temporal/simulate/activities.py (5352 lines)"}, "properties": {"repobilityId": "13f37b218116b91c", "scanner": "scanner-primary", "fingerprint": "ef4f91e7639eb130", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-302cd442ece991cf", "level": "note", "message": {"text": "Very large file: futureagi/tfc/temporal/experiments/activities.py (2833 lines)"}, "properties": {"repobilityId": "9226cb86db8c8170", "scanner": "scanner-primary", "fingerprint": "302cd442ece991cf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d9d4cdfef5787cba", "level": "note", "message": {"text": "Very large file: futureagi/tfc/temporal/experiments/workflows.py (1648 lines)"}, "properties": {"repobilityId": "4d30cd7a118728d9", "scanner": "scanner-primary", "fingerprint": "d9d4cdfef5787cba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5a9c85888f068387", "level": "note", "message": {"text": "Very large file: futureagi/tfc/management/commands/seed_dummy_data.py (1512 lines)"}, "properties": {"repobilityId": "7af019c8500139b6", "scanner": "scanner-primary", "fingerprint": "5a9c85888f068387", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-49c170c32ed82d53", "level": "note", "message": {"text": "Very large file: futureagi/tfc/telemetry/instrumentation.py (1797 lines)"}, "properties": {"repobilityId": "06a9d57c6ee6c582", "scanner": "scanner-primary", "fingerprint": "49c170c32ed82d53", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-75878576aaf803c1", "level": "note", "message": {"text": "Very large file: futureagi/mcp_server/tests/test_mcp_e2e.py (1488 lines)"}, "properties": {"repobilityId": "11aa7f31c1ba9268", "scanner": "scanner-primary", "fingerprint": "75878576aaf803c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a108626805ba02d4", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/litellm_response.py (3455 lines)"}, "properties": {"repobilityId": "58e96db009e7ae9b", "scanner": "scanner-primary", "fingerprint": "a108626805ba02d4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5de563260d6a4a24", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/available_models.py (7488 lines)"}, "properties": {"repobilityId": "66fb28dc4de03c5c", "scanner": "scanner-primary", "fingerprint": "5de563260d6a4a24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7e8c88bf78844120", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/tests/test_live_all_providers.py (2244 lines)"}, "properties": {"repobilityId": "e7e3e4d59ef468f3", "scanner": "scanner-primary", "fingerprint": "7e8c88bf78844120", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a0c1afc19a73e95f", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/tests/test_run_prompt.py (1563 lines)"}, "properties": {"repobilityId": "27e15f270419b059", "scanner": "scanner-primary", "fingerprint": "a0c1afc19a73e95f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-226a208867b47484", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core_evals/run_prompt/runprompt_handlers/tests/test_handlers.py (2173 lines)"}, "properties": {"repobilityId": "c223729500e2ffde", "scanner": "scanner-primary", "fingerprint": "226a208867b47484", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d4c1fede16d07bfb", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core_evals/fi_evals/function/functions.py (4103 lines)"}, "properties": {"repobilityId": "89d87378e3a686f0", "scanner": "scanner-primary", "fingerprint": "d4c1fede16d07bfb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-50fd83cf64b8162d", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core/embeddings/embedding_manager.py (1609 lines)"}, "properties": {"repobilityId": "71add97f0e6cfc09", "scanner": "scanner-primary", "fingerprint": "50fd83cf64b8162d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-87f6952daef44752", "level": "note", "message": {"text": "Very large file: futureagi/agentic_eval/core/llm/llm.py (2322 lines)"}, "properties": {"repobilityId": "047e46c73af5bb87", "scanner": "scanner-primary", "fingerprint": "87f6952daef44752", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-914129673ccf8765", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_trace.py (1517 lines)"}, "properties": {"repobilityId": "e56b7b96f6f6496a", "scanner": "scanner-primary", "fingerprint": "914129673ccf8765", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9db2589fa6932fe7", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_dashboard.py (13641 lines)"}, "properties": {"repobilityId": "ac4585dded1b861a", "scanner": "scanner-primary", "fingerprint": "9db2589fa6932fe7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bdfe23b774915a02", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_bounded_trace_filter_reads.py (16103 lines)"}, "properties": {"repobilityId": "a277a7d1a07ea3f0", "scanner": "scanner-primary", "fingerprint": "bdfe23b774915a02", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0e6d1290d26a5f1c", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_dashboard_exact_candidate_optimization.py (1344 lines)"}, "properties": {"repobilityId": "f56b8b90b641501f", "scanner": "scanner-primary", "fingerprint": "0e6d1290d26a5f1c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-220758dbbbfc0023", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_eval_task_bounded_selector.py (3220 lines)"}, "properties": {"repobilityId": "ad118eef1ec2c647", "scanner": "scanner-primary", "fingerprint": "220758dbbbfc0023", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-54986fc06100f3c1", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_trace_session.py (3614 lines)"}, "properties": {"repobilityId": "aaeae3f51fc72bda", "scanner": "scanner-primary", "fingerprint": "54986fc06100f3c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-05c28ca5d6f1aea5", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_bounded_filter_key_ch25.py (3542 lines)"}, "properties": {"repobilityId": "171c82e81fb7cc98", "scanner": "scanner-primary", "fingerprint": "05c28ca5d6f1aea5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-027d6a8272486a17", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_attribute_reads_recut.py (14336 lines)"}, "properties": {"repobilityId": "e7825ad23e05a250", "scanner": "scanner-primary", "fingerprint": "027d6a8272486a17", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b88bcc1e447749c3", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_session_user_candidate_reads.py (2747 lines)"}, "properties": {"repobilityId": "57876772b5908cdc", "scanner": "scanner-primary", "fingerprint": "b88bcc1e447749c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-241bbc0298196cbf", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_voice_call_annotation_filters.py (1797 lines)"}, "properties": {"repobilityId": "99973dadba13012a", "scanner": "scanner-primary", "fingerprint": "241bbc0298196cbf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7c531d22ea7d721f", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_clickhouse.py (10158 lines)"}, "properties": {"repobilityId": "1cc22819eef0fcd9", "scanner": "scanner-primary", "fingerprint": "7c531d22ea7d721f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3b78e46e47b09654", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_property_catalog_dev_rollout.py (3020 lines)"}, "properties": {"repobilityId": "d8abfbe56fa1ceae", "scanner": "scanner-primary", "fingerprint": "3b78e46e47b09654", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-751c80629d97ef41", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_filter_serializer_contracts.py (1526 lines)"}, "properties": {"repobilityId": "13a574b3015183e9", "scanner": "scanner-primary", "fingerprint": "751c80629d97ef41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-163fbc0c7c488611", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_retell_poll_orchestration.py (4249 lines)"}, "properties": {"repobilityId": "d6116dac68123419", "scanner": "scanner-primary", "fingerprint": "163fbc0c7c488611", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6dbe2c4fd471bf0c", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_property_catalog_durable_lifecycle.py (1660 lines)"}, "properties": {"repobilityId": "f06e8c6ba6dbacc8", "scanner": "scanner-primary", "fingerprint": "6dbe2c4fd471bf0c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d33ece04382be199", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_exact_graph_anchor_partition.py (1592 lines)"}, "properties": {"repobilityId": "0a5c969001afa990", "scanner": "scanner-primary", "fingerprint": "d33ece04382be199", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-824d4e8939df3903", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_bounded_graph_reads.py (4764 lines)"}, "properties": {"repobilityId": "40530b94be2f9a7b", "scanner": "scanner-primary", "fingerprint": "824d4e8939df3903", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a9365cff1bcebcc", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_session_list_bounded_view.py (1755 lines)"}, "properties": {"repobilityId": "e426e7a5d34ec766", "scanner": "scanner-primary", "fingerprint": "7a9365cff1bcebcc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-00d10ee9a5b91308", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_observation_span.py (1462 lines)"}, "properties": {"repobilityId": "c30d3b787f946b0b", "scanner": "scanner-primary", "fingerprint": "00d10ee9a5b91308", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-964920f2970becc0", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_continuous_eval_task_contract.py (2150 lines)"}, "properties": {"repobilityId": "6ccd676786145178", "scanner": "scanner-primary", "fingerprint": "964920f2970becc0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-14746a6a309a5c75", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_user_list_cursor.py (1627 lines)"}, "properties": {"repobilityId": "62e6213ef7cfbc0b", "scanner": "scanner-primary", "fingerprint": "14746a6a309a5c75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eaa6b601bbbec49e", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_observability_providers.py (2537 lines)"}, "properties": {"repobilityId": "ef652b89606fde34", "scanner": "scanner-primary", "fingerprint": "eaa6b601bbbec49e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-48906881ccfff484", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/test_exact_aggregation_contract.py (8071 lines)"}, "properties": {"repobilityId": "06329b06f880e09d", "scanner": "scanner-primary", "fingerprint": "48906881ccfff484", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-87898a4f7c7f0de6", "level": "note", "message": {"text": "Very large file: futureagi/tracer/tests/adapters/test_e2e_adapters.py (1584 lines)"}, "properties": {"repobilityId": "0aa33e36e3310147", "scanner": "scanner-primary", "fingerprint": "87898a4f7c7f0de6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab50ba2a7f8dfe89", "level": "note", "message": {"text": "Very large file: futureagi/tracer/utils/eval.py (4392 lines)"}, "properties": {"repobilityId": "bc115741c210761a", "scanner": "scanner-primary", "fingerprint": "ab50ba2a7f8dfe89", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c1556bfd2401732", "level": "note", "message": {"text": "Very large file: futureagi/tracer/utils/otel.py (1812 lines)"}, "properties": {"repobilityId": "91fa2454309a4e3a", "scanner": "scanner-primary", "fingerprint": "2c1556bfd2401732", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7c3c43770da3e482", "level": "note", "message": {"text": "Very large file: futureagi/tracer/utils/filters.py (2528 lines)"}, "properties": {"repobilityId": "6a5f96f63a81bc5d", "scanner": "scanner-primary", "fingerprint": "7c3c43770da3e482", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c9f0f8f89565a5d", "level": "note", "message": {"text": "Very large file: futureagi/tracer/utils/observability_provider.py (1439 lines)"}, "properties": {"repobilityId": "0bdc9adeb302e5e1", "scanner": "scanner-primary", "fingerprint": "2c9f0f8f89565a5d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d69e301532240a05", "level": "note", "message": {"text": "Very large file: futureagi/tracer/serializers/filters.py (1451 lines)"}, "properties": {"repobilityId": "7559e32ce2b1daf1", "scanner": "scanner-primary", "fingerprint": "d69e301532240a05", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f3f32f2775fa2c1b", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/users_list_manager.py (2132 lines)"}, "properties": {"repobilityId": "e42c398137541948", "scanner": "scanner-primary", "fingerprint": "f3f32f2775fa2c1b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-78bdceb3e472b736", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/dashboard_metrics_catalog.py (2230 lines)"}, "properties": {"repobilityId": "85ba06508959a650", "scanner": "scanner-primary", "fingerprint": "78bdceb3e472b736", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7e266e39e45ad4e9", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/exact_aggregation_cache.py (1635 lines)"}, "properties": {"repobilityId": "6ae6bb29c9dac782", "scanner": "scanner-primary", "fingerprint": "7e266e39e45ad4e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-435f40e81685e119", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/observability_providers.py (1557 lines)"}, "properties": {"repobilityId": "64b8273ba57ce737", "scanner": "scanner-primary", "fingerprint": "435f40e81685e119", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1fa9dc5030e184b1", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/graph_dispatch.py (2306 lines)"}, "properties": {"repobilityId": "3566efa4abb479f3", "scanner": "scanner-primary", "fingerprint": "1fa9dc5030e184b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f0cf568e9d292cc0", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/exact_graph_reads.py (4824 lines)"}, "properties": {"repobilityId": "3e1bb5b56f0eaf9f", "scanner": "scanner-primary", "fingerprint": "f0cf568e9d292cc0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-08e07112b3b93091", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/bounded_graph_reads.py (1546 lines)"}, "properties": {"repobilityId": "2fa9e16cc8a12355", "scanner": "scanner-primary", "fingerprint": "08e07112b3b93091", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-97fc3d873f7a4fcd", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/schema.py (2317 lines)"}, "properties": {"repobilityId": "8e83bd1cc2814372", "scanner": "scanner-primary", "fingerprint": "97fc3d873f7a4fcd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-22ea8102b3c1e88a", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/attribute_cursor_state.py (1584 lines)"}, "properties": {"repobilityId": "16768fba06bbcc6b", "scanner": "scanner-primary", "fingerprint": "22ea8102b3c1e88a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-966b4519fe66346f", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/attribute_reads.py (6623 lines)"}, "properties": {"repobilityId": "10704526083ae88c", "scanner": "scanner-primary", "fingerprint": "966b4519fe66346f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-27a946d47e954a34", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/span_reader.py (3104 lines)"}, "properties": {"repobilityId": "e4c0bbf2a4f0da5e", "scanner": "scanner-primary", "fingerprint": "27a946d47e954a34", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f8acb209059153c", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/attribute_catalog_backfill.py (2219 lines)"}, "properties": {"repobilityId": "93578e6732a16070", "scanner": "scanner-primary", "fingerprint": "2f8acb209059153c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6f48e1b3aa2d2071", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/attribute_catalog_reader.py (1849 lines)"}, "properties": {"repobilityId": "5d34f86293f92377", "scanner": "scanner-primary", "fingerprint": "6f48e1b3aa2d2071", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2bddde6ccdef832b", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/query_builders/trace_list.py (1345 lines)"}, "properties": {"repobilityId": "ae171745df3911ae", "scanner": "scanner-primary", "fingerprint": "2bddde6ccdef832b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f0b5ed4ba92d1fac", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/dev_runtime.py (5009 lines)"}, "properties": {"repobilityId": "9a65f09cf5b6914d", "scanner": "scanner-primary", "fingerprint": "f0b5ed4ba92d1fac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b51a5f392f697508", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/durable_lifecycle.py (2679 lines)"}, "properties": {"repobilityId": "a5c74c0490b4528e", "scanner": "scanner-primary", "fingerprint": "b51a5f392f697508", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fb6c23ef89148ea3", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/coordinator.py (1765 lines)"}, "properties": {"repobilityId": "f1f1c1dd9f558dd8", "scanner": "scanner-primary", "fingerprint": "fb6c23ef89148ea3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3bea7ed2f79c97e4", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/state_store.py (1667 lines)"}, "properties": {"repobilityId": "96094661fdf3f63f", "scanner": "scanner-primary", "fingerprint": "3bea7ed2f79c97e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d455ef9b782aac24", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/span_source.py (2342 lines)"}, "properties": {"repobilityId": "c34c369f7207e495", "scanner": "scanner-primary", "fingerprint": "d455ef9b782aac24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-287b7c7334278a15", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/reader.py (1843 lines)"}, "properties": {"repobilityId": "f07539dc7cc5d7bd", "scanner": "scanner-primary", "fingerprint": "287b7c7334278a15", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e1fa58022400d64b", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/v2/property_catalog/source_adapters.py (2323 lines)"}, "properties": {"repobilityId": "8395827caf24776a", "scanner": "scanner-primary", "fingerprint": "e1fa58022400d64b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-87284e639c7e7165", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/span_list.py (2609 lines)"}, "properties": {"repobilityId": "39291d2e5f624cea", "scanner": "scanner-primary", "fingerprint": "87284e639c7e7165", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-15738d90bbc74fbe", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/voice_call_list.py (1360 lines)"}, "properties": {"repobilityId": "33cda27933687c93", "scanner": "scanner-primary", "fingerprint": "15738d90bbc74fbe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-359b013068d6cd29", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/user_list.py (2327 lines)"}, "properties": {"repobilityId": "03826c858a16d5c8", "scanner": "scanner-primary", "fingerprint": "359b013068d6cd29", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-321caf2ea7b3e30a", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/dashboard.py (3890 lines)"}, "properties": {"repobilityId": "c390f4496039e2eb", "scanner": "scanner-primary", "fingerprint": "321caf2ea7b3e30a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bb31149a8e09f5a0", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/session_list.py (3471 lines)"}, "properties": {"repobilityId": "ea012fbba43906d0", "scanner": "scanner-primary", "fingerprint": "bb31149a8e09f5a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ce3f4aa1cea0061b", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/filters.py (3000 lines)"}, "properties": {"repobilityId": "745b25fc897ce288", "scanner": "scanner-primary", "fingerprint": "ce3f4aa1cea0061b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eb27d6d81811bcc9", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/latest_filter_predicates.py (2047 lines)"}, "properties": {"repobilityId": "35028bbc0442d2c5", "scanner": "scanner-primary", "fingerprint": "eb27d6d81811bcc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-75d724b09d2d2afb", "level": "note", "message": {"text": "Very large file: futureagi/tracer/services/clickhouse/query_builders/trace_list.py (5962 lines)"}, "properties": {"repobilityId": "a20c2f5026b5de22", "scanner": "scanner-primary", "fingerprint": "75d724b09d2d2afb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-165c1f628414502e", "level": "note", "message": {"text": "Very large file: futureagi/tracer/queries/feed.py (3400 lines)"}, "properties": {"repobilityId": "7870a295bfceaeda", "scanner": "scanner-primary", "fingerprint": "165c1f628414502e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-20be2b7eb7a139d9", "level": "note", "message": {"text": "Very large file: futureagi/tracer/queries/error_analysis.py (1487 lines)"}, "properties": {"repobilityId": "cd85a850f2386a59", "scanner": "scanner-primary", "fingerprint": "20be2b7eb7a139d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ae6e0c79bd5be749", "level": "note", "message": {"text": "Very large file: futureagi/tracer/selectors/trace_filter_reads.py (3814 lines)"}, "properties": {"repobilityId": "85dce498c846b824", "scanner": "scanner-primary", "fingerprint": "ae6e0c79bd5be749", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5a35f3d634f4c9d6", "level": "note", "message": {"text": "Very large file: futureagi/tracer/selectors/eval_tasks/row_resolver.py (1716 lines)"}, "properties": {"repobilityId": "4ca40d2b20afce96", "scanner": "scanner-primary", "fingerprint": "5a35f3d634f4c9d6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1a99795e707c3033", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/dashboard.py (7330 lines)"}, "properties": {"repobilityId": "cd011a54d6057c11", "scanner": "scanner-primary", "fingerprint": "1a99795e707c3033", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-55345d5024c202bd", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/span_attributes.py (1193 lines)"}, "properties": {"repobilityId": "2eac5346d71a5e5d", "scanner": "scanner-primary", "fingerprint": "55345d5024c202bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9b311c0433d24240", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/observation_span.py (5303 lines)"}, "properties": {"repobilityId": "9c8733bf1b5e6440", "scanner": "scanner-primary", "fingerprint": "9b311c0433d24240", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-00748795188208da", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/eval_task.py (3274 lines)"}, "properties": {"repobilityId": "4102d7dc79645710", "scanner": "scanner-primary", "fingerprint": "00748795188208da", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9e4662579a625eec", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/annotation.py (1364 lines)"}, "properties": {"repobilityId": "bea1adc816083d55", "scanner": "scanner-primary", "fingerprint": "9e4662579a625eec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3d356ce7eb0a09e8", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/project.py (1426 lines)"}, "properties": {"repobilityId": "2d8df0945fe0b51d", "scanner": "scanner-primary", "fingerprint": "3d356ce7eb0a09e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-58573e635d4194db", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/project_version.py (2074 lines)"}, "properties": {"repobilityId": "6b1ecd2c70b4e2ed", "scanner": "scanner-primary", "fingerprint": "58573e635d4194db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-32a329b77f40386e", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/trace.py (7242 lines)"}, "properties": {"repobilityId": "7872f482ef749520", "scanner": "scanner-primary", "fingerprint": "32a329b77f40386e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-688c0a4bae038561", "level": "note", "message": {"text": "Very large file: futureagi/tracer/views/trace_session.py (4096 lines)"}, "properties": {"repobilityId": "37ff4c2b50c51e98", "scanner": "scanner-primary", "fingerprint": "688c0a4bae038561", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3a43490a1f0961ec", "level": "note", "message": {"text": "Very large file: futureagi/sdk/tests/test_analytics.py (1809 lines)"}, "properties": {"repobilityId": "42d61b01d865e478", "scanner": "scanner-primary", "fingerprint": "3a43490a1f0961ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-28d177604e4455d3", "level": "note", "message": {"text": "Very large file: futureagi/ee/usage/utils/usage_entries.py (3019 lines)"}, "properties": {"repobilityId": "92ac1c45fc42ea87", "scanner": "scanner-primary", "fingerprint": "28d177604e4455d3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9d6d9a01a19b470", "level": "note", "message": {"text": "Very large file: futureagi/ee/tests/test_deterministic_evaluator.py (1524 lines)"}, "properties": {"repobilityId": "1694c3fcea0308fa", "scanner": "scanner-primary", "fingerprint": "f9d6d9a01a19b470", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8baa5c7c1788f7e6", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/fix_your_agent/fix_your_agent.py (1533 lines)"}, "properties": {"repobilityId": "fd138fd2232afcfe", "scanner": "scanner-primary", "fingerprint": "8baa5c7c1788f7e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a8984304eb17f73", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/fix_your_agent/simulation_adapter.py (2473 lines)"}, "properties": {"repobilityId": "7e6d648783287938", "scanner": "scanner-primary", "fingerprint": "7a8984304eb17f73", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4ed48cbe68046e75", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py (2265 lines)"}, "properties": {"repobilityId": "0509dcb1ba0935d4", "scanner": "scanner-primary", "fingerprint": "4ed48cbe68046e75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f417497e360e8437", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/scenario_graph/old_graph_generator.py (1755 lines)"}, "properties": {"repobilityId": "611d6385c47ffac5", "scanner": "scanner-primary", "fingerprint": "f417497e360e8437", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-84d2b884f5bf26b5", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/eval_orchestrator/orchestrator.py (1514 lines)"}, "properties": {"repobilityId": "2711f620a8acee61", "scanner": "scanner-primary", "fingerprint": "84d2b884f5bf26b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-36f240e48d3a2c80", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/eval_orchestrator/run_real_integration_tests.py (1047 lines)"}, "properties": {"repobilityId": "811b9f2ea71577dd", "scanner": "scanner-primary", "fingerprint": "36f240e48d3a2c80", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ce7e7dc9e0f3db50", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/cluster_rca/agent.py (3025 lines)"}, "properties": {"repobilityId": "97dbef81a294909c", "scanner": "scanner-primary", "fingerprint": "ce7e7dc9e0f3db50", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-430500ee9071ae36", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/prompts.py (1195 lines)"}, "properties": {"repobilityId": "b6602cf4f0dead8f", "scanner": "scanner-primary", "fingerprint": "430500ee9071ae36", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bf3d7033bae6218f", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py (4187 lines)"}, "properties": {"repobilityId": "3ae9a9463ea71f48", "scanner": "scanner-primary", "fingerprint": "bf3d7033bae6218f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3faa28162d77a310", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent_old.py (1563 lines)"}, "properties": {"repobilityId": "069f996b50e6feba", "scanner": "scanner-primary", "fingerprint": "3faa28162d77a310", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b1208616e2e966b6", "level": "note", "message": {"text": "Very large file: futureagi/ee/agenthub/prompt_generate_agent/prompt_generate.py (1823 lines)"}, "properties": {"repobilityId": "49dceb53fb13e1e5", "scanner": "scanner-primary", "fingerprint": "b1208616e2e966b6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-95fd6a857344b9ed", "level": "note", "message": {"text": "Very large file: futureagi/ee/voice/tests/test_phone_number_dispatcher.py (1272 lines)"}, "properties": {"repobilityId": "76209059d9605de1", "scanner": "scanner-primary", "fingerprint": "95fd6a857344b9ed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4534687de722ed2b", "level": "note", "message": {"text": "Very large file: futureagi/ee/voice/constants/voice_mapper.py (2888 lines)"}, "properties": {"repobilityId": "49554e9fd8300c27", "scanner": "scanner-primary", "fingerprint": "4534687de722ed2b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a922bfaefbc911d8", "level": "note", "message": {"text": "Very large file: futureagi/ee/voice/temporal/workflows/call_execution_workflow.py (1651 lines)"}, "properties": {"repobilityId": "4e467da706a82045", "scanner": "scanner-primary", "fingerprint": "a922bfaefbc911d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4aa031b72595e88e", "level": "note", "message": {"text": "Very large file: futureagi/ee/voice/services/vapi_service.py (2841 lines)"}, "properties": {"repobilityId": "56a1fc7012368037", "scanner": "scanner-primary", "fingerprint": "4aa031b72595e88e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-16382b2e7841b805", "level": "note", "message": {"text": "Very large file: futureagi/ee/evals/llm/agent_evaluator/evaluator.py (2887 lines)"}, "properties": {"repobilityId": "12bbef3d88997c1d", "scanner": "scanner-primary", "fingerprint": "16382b2e7841b805", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-255987f3233320bd", "level": "note", "message": {"text": "Very large file: scripts/qa/replay_observe_queries_readonly.py (1529 lines)"}, "properties": {"repobilityId": "ea78cb43af4507f8", "scanner": "scanner-primary", "fingerprint": "255987f3233320bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-59d9de5a46bbb2c2", "level": "note", "message": {"text": "Very large file: scripts/qa/test_observe_span_reference.py (1979 lines)"}, "properties": {"repobilityId": "c7772d5266eb3a6b", "scanner": "scanner-primary", "fingerprint": "59d9de5a46bbb2c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4e095c9385b50218", "level": "note", "message": {"text": "Very large file: scripts/qa/test_replay_observe_queries_readonly.py (1141 lines)"}, "properties": {"repobilityId": "4877570b1fe795b0", "scanner": "scanner-primary", "fingerprint": "4e095c9385b50218", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a08346faef6a116", "level": "note", "message": {"text": "Very large file: scripts/qa/test_observe_trace_id_reference.py (1576 lines)"}, "properties": {"repobilityId": "b7ae3de323ec7715", "scanner": "scanner-primary", "fingerprint": "7a08346faef6a116", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c39fd040f4a2427c", "level": "note", "message": {"text": "Very large file: scripts/qa/replay_observe_filters.py (1373 lines)"}, "properties": {"repobilityId": "76d6044d415da9ac", "scanner": "scanner-primary", "fingerprint": "c39fd040f4a2427c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a0812f025023861", "level": "note", "message": {"text": "Very large file: deploy/dev/property-catalog/render.py (1633 lines)"}, "properties": {"repobilityId": "f073a2de666fc419", "scanner": "scanner-primary", "fingerprint": "6a0812f025023861", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3feabcf644e0a9cf", "level": "note", "message": {"text": "Very large file: deploy/dev/property-catalog-docker/render.py (1342 lines)"}, "properties": {"repobilityId": "a6e54bb5cb47aa57", "scanner": "scanner-primary", "fingerprint": "3feabcf644e0a9cf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b469c772b8c62615", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/routing/routing_test.go (3404 lines)"}, "properties": {"repobilityId": "3e737a7fb088ab87", "scanner": "scanner-primary", "fingerprint": "b469c772b8c62615", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eea0788593c1248b", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/config/config.go (1349 lines)"}, "properties": {"repobilityId": "c973ec50d9d58729", "scanner": "scanner-primary", "fingerprint": "eea0788593c1248b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-89ef635123d94d73", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/mcp/server_test.go (1710 lines)"}, "properties": {"repobilityId": "be225660361cac06", "scanner": "scanner-primary", "fingerprint": "89ef635123d94d73", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fb2ef7946e8a75ab", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/providers/bedrock/translate_test.go (1951 lines)"}, "properties": {"repobilityId": "d942093c46097b75", "scanner": "scanner-primary", "fingerprint": "fb2ef7946e8a75ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c9b617dd3209c52f", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/providers/gemini/translate_test.go (2064 lines)"}, "properties": {"repobilityId": "798051f5d5c023fe", "scanner": "scanner-primary", "fingerprint": "c9b617dd3209c52f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e3cb6f19cad33d4a", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/providers/anthropic/translate_test.go (1929 lines)"}, "properties": {"repobilityId": "90af1d55d35f9a08", "scanner": "scanner-primary", "fingerprint": "e3cb6f19cad33d4a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2391d05a595d0753", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/server/handlers.go (2291 lines)"}, "properties": {"repobilityId": "1521d7e8508c30fb", "scanner": "scanner-primary", "fingerprint": "2391d05a595d0753", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-effec56ad912c4bd", "level": "note", "message": {"text": "Very large file: agentcc-gateway/internal/server/server_test.go (2287 lines)"}, "properties": {"repobilityId": "c0335e2c04ca775d", "scanner": "scanner-primary", "fingerprint": "effec56ad912c4bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-777a13c1a0a37351", "level": "note", "message": {"text": "64 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "777a13c1a0a37351", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0b9b4469b6632a28", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "0c45db416b40b34b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "e8320d8b3a4f3bd0", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "756d023ea42957e1", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-dc5e54ab3a72535e", "level": "note", "message": {"text": "Legacy-named symbol `cs_api_journey_legacy` in frontend/scripts/api-journeys/journeys/app-core.mjs:7102"}, "properties": {"repobilityId": "46fa28709142195f", "scanner": "scanner-primary", "fingerprint": "dc5e54ab3a72535e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fa7cfd04a11cc70a", "level": "note", "message": {"text": "Legacy-named symbol `allow_copy` in frontend/scripts/api-journeys/journeys/simulation-agentcc.mjs:10836"}, "properties": {"repobilityId": "007df2020584d5b9", "scanner": "scanner-primary", "fingerprint": "fa7cfd04a11cc70a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-656d3509e4f0f80f", "level": "note", "message": {"text": "Legacy-named symbol `model_deprecated` in frontend/src/generated/api-contracts/api.schemas.ts:7960"}, "properties": {"repobilityId": "01cb8e3f5e8ffe6f", "scanner": "scanner-primary", "fingerprint": "656d3509e4f0f80f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d46c4996c028d8c5", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/utils/utils.js:211"}, "properties": {"repobilityId": "d49f209d8a1b2d88", "scanner": "scanner-primary", "fingerprint": "d46c4996c028d8c5", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/utils/utils.js"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-8128d7eff56baf54", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/utils/Mixpanel/EventNames.js:319"}, "properties": {"repobilityId": "5edfd307cc1321b1", "scanner": "scanner-primary", "fingerprint": "8128d7eff56baf54", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/utils/Mixpanel/EventNames.js"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-81439b9f669e1a68", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/components/VariableDrawer/VariableDrawer.jsx:289"}, "properties": {"repobilityId": "54c90c7a47143929", "scanner": "scanner-primary", "fingerprint": "81439b9f669e1a68", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/VariableDrawer/VariableDrawer.jsx"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-2d92a5516aeac6f2", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/DateRangePicker/DateRangerPicker.stories.jsx:12"}, "properties": {"repobilityId": "20509a3537109a23", "scanner": "scanner-primary", "fingerprint": "2d92a5516aeac6f2", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/DateRangePicker/DateRangerPicker.stories.jsx"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-2d13afea0e4d27ce", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/EndCallNode.jsx:117"}, "properties": {"repobilityId": "0df20e96b566d063", "scanner": "scanner-primary", "fingerprint": "2d13afea0e4d27ce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c59ff35bbd68dfec", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/TransferChatNode.jsx:118"}, "properties": {"repobilityId": "94706c237bf158b6", "scanner": "scanner-primary", "fingerprint": "c59ff35bbd68dfec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6cabfb0a63d5a0f8", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/TransferCallNode.jsx:118"}, "properties": {"repobilityId": "109c3676223db214", "scanner": "scanner-primary", "fingerprint": "6cabfb0a63d5a0f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f12e808943d9a474", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/EndChatNode.jsx:117"}, "properties": {"repobilityId": "e2a44a8d5617e759", "scanner": "scanner-primary", "fingerprint": "f12e808943d9a474", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-17249b88c9e67454", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/GraphBuilder/nodes/ConversationNode.jsx:167"}, "properties": {"repobilityId": "1da064d88832864e", "scanner": "scanner-primary", "fingerprint": "17249b88c9e67454", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fbc58474d81d2c34", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/prompt-section/PromptSection.jsx:245"}, "properties": {"repobilityId": "7c45cde491e17b73", "scanner": "scanner-primary", "fingerprint": "fbc58474d81d2c34", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/prompt-section/PromptSection.jsx"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-a81bf284a6192adf", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/components/websocket/use-socket.jsx:247"}, "properties": {"repobilityId": "391b1efb7e9c49c1", "scanner": "scanner-primary", "fingerprint": "a81bf284a6192adf", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/websocket/use-socket.jsx"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-3784de19afd11ec4", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/custom-model-options/CreateResponseSchema.jsx:285"}, "properties": {"repobilityId": "eca1007cd4f7fc0f", "scanner": "scanner-primary", "fingerprint": "3784de19afd11ec4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-10ee823d54414d7c", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/ImprovePromptDrawer/ImporvedPromptHeader.jsx:96"}, "properties": {"repobilityId": "388a59cceb139e99", "scanner": "scanner-primary", "fingerprint": "10ee823d54414d7c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1437208a0867a4b3", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/PromptCards/common.js:645"}, "properties": {"repobilityId": "c699f450c198eb79", "scanner": "scanner-primary", "fingerprint": "1437208a0867a4b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e8dc818d5ae1b6a2", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/components/custom-audio/audioHelper.js:59"}, "properties": {"repobilityId": "bd31982c98107f03", "scanner": "scanner-primary", "fingerprint": "e8dc818d5ae1b6a2", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/custom-audio/audioHelper.js"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-71c22f99d28494c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/traceDetailDrawer/BottomAnnotationTab/bottom-annotations-tab.jsx:62"}, "properties": {"repobilityId": "3d2419d682a13639", "scanner": "scanner-primary", "fingerprint": "71c22f99d28494c3", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/traceDetailDrawer/BottomAnnotationTab/bottom-annotations-tab.jsx"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-ec9f17f96b58097c", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/components/traceDetailDrawer/CustomRenderer/EvalsCustomCellRenderer.jsx:191"}, "properties": {"repobilityId": "82c735f1cf4953bc", "scanner": "scanner-primary", "fingerprint": "ec9f17f96b58097c", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/traceDetailDrawer/CustomRenderer/EvalsCustomCellRenderer.jsx"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-bdde56143b5992bd", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/components/logo/logo.jsx:18"}, "properties": {"repobilityId": "093035ae767e4903", "scanner": "scanner-primary", "fingerprint": "bdde56143b5992bd", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/logo/logo.jsx"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-38fd2be625de0b7d", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/components/custom-model-tools/EditTool.jsx:241"}, "properties": {"repobilityId": "82ccb3c9db38a507", "scanner": "scanner-primary", "fingerprint": "38fd2be625de0b7d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c5d7ca3dc82a2c30", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/components/custom-model-dropdown/ModelButtonField.jsx:52"}, "properties": {"repobilityId": "023551f9e08ef5b2", "scanner": "scanner-primary", "fingerprint": "c5d7ca3dc82a2c30", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/custom-model-dropdown/ModelButtonField.jsx"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-1d3912d4ec3d759b", "level": "none", "message": {"text": "Commented-code block (11 lines) in frontend/src/components/custom-model-dropdown/CloudProviderModals.jsx:58"}, "properties": {"repobilityId": "2a2b252c59e141e2", "scanner": "scanner-primary", "fingerprint": "1d3912d4ec3d759b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/custom-model-dropdown/CloudProviderModals.jsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-c2297f3a797fb19b", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/components/ConfigureApiKeysModal/ConfigureKeysContent.jsx:34"}, "properties": {"repobilityId": "5d5d6b15ac6c0b4f", "scanner": "scanner-primary", "fingerprint": "c2297f3a797fb19b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ConfigureApiKeysModal/ConfigureKeysContent.jsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-a85247ee4ca1d9db", "level": "none", "message": {"text": "Commented-code block (13 lines) in frontend/src/routes/sections/dashboard.jsx:446"}, "properties": {"repobilityId": "3d677f6e255ba234", "scanner": "scanner-primary", "fingerprint": "a85247ee4ca1d9db", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/routes/sections/dashboard.jsx"}, "region": {"startLine": 446}}}]}, {"ruleId": "scanner-54cd36127a8a1919", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/pages/dashboard/settings/InvoiceHistoryTable.jsx:22"}, "properties": {"repobilityId": "ae4e21b4bf3c6847", "scanner": "scanner-primary", "fingerprint": "54cd36127a8a1919", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/dashboard/settings/InvoiceHistoryTable.jsx"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-838ebd03dc7c00c8", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/pages/dashboard/settings/IconComponents.jsx:60"}, "properties": {"repobilityId": "79f48af3617d9cff", "scanner": "scanner-primary", "fingerprint": "838ebd03dc7c00c8", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/dashboard/settings/IconComponents.jsx"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-f2207eb74cee4ac7", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/pages/dashboard/settings/InvitationsTable.jsx:212"}, "properties": {"repobilityId": "2fb7336ed5230ebb", "scanner": "scanner-primary", "fingerprint": "f2207eb74cee4ac7", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/dashboard/settings/InvitationsTable.jsx"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-16817e295c991a82", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/pages/dashboard/settings/api-keys/CreateApiKey.jsx:157"}, "properties": {"repobilityId": "7c8f88a4b8b79117", "scanner": "scanner-primary", "fingerprint": "16817e295c991a82", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6dd56fe4c97172ba", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/pages/dashboard/settings/UserManagementV2/WorkSpaceManagement.jsx:239"}, "properties": {"repobilityId": "2f6ed467ca64a87a", "scanner": "scanner-primary", "fingerprint": "6dd56fe4c97172ba", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/dashboard/settings/UserManagementV2/WorkSpaceManagement.jsx"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-a34e0a7cad3a7c68", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/pages/dashboard/models/Performance/PerformanceTable.jsx:74"}, "properties": {"repobilityId": "aa7b93ec670ebf23", "scanner": "scanner-primary", "fingerprint": "a34e0a7cad3a7c68", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/pages/dashboard/models/Performance/PerformanceTable.jsx"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-ce6b011af54e2cf5", "level": "none", "message": {"text": "Commented-code block (13 lines) in frontend/src/sections/prompt/NewPrompt/TopMenuOptions/ImportDataset.jsx:144"}, "properties": {"repobilityId": "5e2207d18c5ab18a", "scanner": "scanner-primary", "fingerprint": "ce6b011af54e2cf5", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/prompt/NewPrompt/TopMenuOptions/ImportDataset.jsx"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-358e833d2b43a33c", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/test-detail/FixMyAgentDrawer/OptimizationDetail/PrompDetails/PromptPanelHeader.jsx:38"}, "properties": {"repobilityId": "89357ba91e64dc8a", "scanner": "scanner-primary", "fingerprint": "358e833d2b43a33c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-15577ecf9374d17a", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/test-detail/CellRenderers/CallDetailCellRenderer.jsx:17"}, "properties": {"repobilityId": "bc8bade51b55c190", "scanner": "scanner-primary", "fingerprint": "15577ecf9374d17a", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/test-detail/CellRenderers/CallDetailCellRenderer.jsx"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-a3330dfc8803cf64", "level": "none", "message": {"text": "Commented-code block (18 lines) in frontend/src/sections/sync/Connectors/ConnectorView.jsx:19"}, "properties": {"repobilityId": "900ec7d85d2458d5", "scanner": "scanner-primary", "fingerprint": "a3330dfc8803cf64", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/sync/Connectors/ConnectorView.jsx"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-9504800c8a23f958", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/sections/develop/AddRowDrawer/CreateSyntheticDataView.jsx:192"}, "properties": {"repobilityId": "58a15b7fd1796da0", "scanner": "scanner-primary", "fingerprint": "9504800c8a23f958", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop/AddRowDrawer/CreateSyntheticDataView.jsx"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-02fd43fdc70ea32b", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/experiment-detail/IndividualDevelopExperimentSelect.jsx:28"}, "properties": {"repobilityId": "c81756694aa92617", "scanner": "scanner-primary", "fingerprint": "02fd43fdc70ea32b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/experiment-detail/IndividualDevelopExperimentSelect.jsx"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-914f6493eb88ba49", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/experiment-detail/ExperimentSummary/CustomRenderers/ExperimentHeader.jsx:53"}, "properties": {"repobilityId": "c80b862452a99ccd", "scanner": "scanner-primary", "fingerprint": "914f6493eb88ba49", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/experiment-detail/ExperimentSummary/CustomRenderers/ExperimentHeader.jsx"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-60a57baccd4d7a0b", "level": "none", "message": {"text": "Commented-code block (9 lines) in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawer.jsx:21"}, "properties": {"repobilityId": "1a3d50d5dc92d610", "scanner": "scanner-primary", "fingerprint": "60a57baccd4d7a0b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawer.jsx"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-dee01dd7e7c05e7d", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDetailDrawerContent.jsx:626"}, "properties": {"repobilityId": "823c6c302e24baa3", "scanner": "scanner-primary", "fingerprint": "dee01dd7e7c05e7d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-95b97f084968ab8e", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/sections/experiment-detail/ExperimentData/ExperimentDataView.jsx:670"}, "properties": {"repobilityId": "2607f0d4f5e9c175", "scanner": "scanner-primary", "fingerprint": "95b97f084968ab8e", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/experiment-detail/ExperimentData/ExperimentDataView.jsx"}, "region": {"startLine": 670}}}]}, {"ruleId": "scanner-54437a1703a40bba", "level": "none", "message": {"text": "Commented-code block (18 lines) in frontend/src/sections/experiment-detail/ExperimentData/IndividualExperimentDataView.jsx:129"}, "properties": {"repobilityId": "c15df49417df417a", "scanner": "scanner-primary", "fingerprint": "54437a1703a40bba", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/experiment-detail/ExperimentData/IndividualExperimentDataView.jsx"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-a1d3e8ee606943ec", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/sections/HeaderComponent/HeaderComponent.jsx:41"}, "properties": {"repobilityId": "e5a72c93cd41339a", "scanner": "scanner-primary", "fingerprint": "a1d3e8ee606943ec", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/HeaderComponent/HeaderComponent.jsx"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-040f3d0b5007905a", "level": "note", "message": {"text": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/projects/legacyPresetInference.js:63"}, "properties": {"repobilityId": "11f100796e0658b4", "scanner": "scanner-primary", "fingerprint": "040f3d0b5007905a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3006db1c92993c8e", "level": "none", "message": {"text": "Commented-code block (11 lines) in frontend/src/sections/projects/ConfigNavData.jsx:96"}, "properties": {"repobilityId": "354e4219354e19cf", "scanner": "scanner-primary", "fingerprint": "3006db1c92993c8e", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/projects/ConfigNavData.jsx"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-7bdf0689393cf5b9", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/TracesDrawer/Header.jsx:59"}, "properties": {"repobilityId": "9c8cdf6a08cc592c", "scanner": "scanner-primary", "fingerprint": "7bdf0689393cf5b9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5f6ccf1e4a0e79ea", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/MonitorsView/MonitorsView.jsx:405"}, "properties": {"repobilityId": "9eb98b8492ee1ba6", "scanner": "scanner-primary", "fingerprint": "5f6ccf1e4a0e79ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0e2cd9f3caa1c954", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/projects/UsersView/UserDetails/UserTraceSessionSection.jsx:116"}, "properties": {"repobilityId": "e883c0057dead679", "scanner": "scanner-primary", "fingerprint": "0e2cd9f3caa1c954", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/projects/UsersView/UserDetails/UserTraceSessionSection.jsx"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-9156325028dcfec4", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/projects/ChartsView/ChartsView.jsx:190"}, "properties": {"repobilityId": "901d06a94644b4a8", "scanner": "scanner-primary", "fingerprint": "9156325028dcfec4", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/projects/ChartsView/ChartsView.jsx"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-be71a1265d59a021", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/projects/SessionsView/ConversationCard.jsx:165"}, "properties": {"repobilityId": "13ddb429663984f9", "scanner": "scanner-primary", "fingerprint": "be71a1265d59a021", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-25e872e62a318d0d", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/projects/SessionsView/ReplaySessions/configurations.js:96"}, "properties": {"repobilityId": "4894c622b390f139", "scanner": "scanner-primary", "fingerprint": "25e872e62a318d0d", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/projects/SessionsView/ReplaySessions/configurations.js"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-6f8dc85e38c03d2f", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx:1036"}, "properties": {"repobilityId": "a19a85f5c795ff39", "scanner": "scanner-primary", "fingerprint": "6f8dc85e38c03d2f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/projects/LLMTracing/LLMTracingView.jsx"}, "region": {"startLine": 1036}}}]}, {"ruleId": "scanner-1469388c16501c49", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/sections/projects/LLMTracing/SpanGrid.jsx:970"}, "properties": {"repobilityId": "d200f27766db6ddf", "scanner": "scanner-primary", "fingerprint": "1469388c16501c49", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/projects/LLMTracing/SpanGrid.jsx"}, "region": {"startLine": 970}}}]}, {"ruleId": "scanner-7a2d1d60d2fee525", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/DevelopeSearch.jsx:40"}, "properties": {"repobilityId": "4d23a3ad64107ea4", "scanner": "scanner-primary", "fingerprint": "7a2d1d60d2fee525", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/common/DevelopeSearch.jsx"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-9ee64c960341ad1e", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/common/DatapointCard.jsx:202"}, "properties": {"repobilityId": "cf93d70cbfdd3f71", "scanner": "scanner-primary", "fingerprint": "9ee64c960341ad1e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-675d4c0c3617e8f1", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx:264"}, "properties": {"repobilityId": "70b669d658303ae0", "scanner": "scanner-primary", "fingerprint": "675d4c0c3617e8f1", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/common/EvaluationDrawer/CustomEvalsForm.jsx"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-21218947ebf39de8", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/CreateEvaluationGroupDrawer.jsx:327"}, "properties": {"repobilityId": "6348d652ff27bc28", "scanner": "scanner-primary", "fingerprint": "21218947ebf39de8", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/common/EvaluationDrawer/CreateEvaluationGroupDrawer.jsx"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-67006b321418cf1f", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/EvaluationMappingForm.jsx:743"}, "properties": {"repobilityId": "393254d34c844d13", "scanner": "scanner-primary", "fingerprint": "67006b321418cf1f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/common/EvaluationDrawer/EvaluationMappingForm.jsx"}, "region": {"startLine": 743}}}]}, {"ruleId": "scanner-ad1c82234e821a64", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/common/EvaluationDrawer/context/EvaluationProvider.jsx:35"}, "properties": {"repobilityId": "e564f25f5e4277a4", "scanner": "scanner-primary", "fingerprint": "ad1c82234e821a64", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/common/EvaluationDrawer/context/EvaluationProvider.jsx"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-b972b9f1238907f0", "level": "note", "message": {"text": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/common/EvalsTasks/common.js:3"}, "properties": {"repobilityId": "42bd8586bab99e7a", "scanner": "scanner-primary", "fingerprint": "b972b9f1238907f0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-103768190fa1b886", "level": "none", "message": {"text": "Commented-code block (9 lines) in frontend/src/sections/develop-detail/Common/EvaluationConfigure/validation.js:118"}, "properties": {"repobilityId": "24b2a58060880b21", "scanner": "scanner-primary", "fingerprint": "103768190fa1b886", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/Common/EvaluationConfigure/validation.js"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-381a34dea575b724", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/Common/CustomModelSelection/CustomModelSelection.jsx:74"}, "properties": {"repobilityId": "444312865e0482d0", "scanner": "scanner-primary", "fingerprint": "381a34dea575b724", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/Common/CustomModelSelection/CustomModelSelection.jsx"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-8da0c6e85c5d325e", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/DevelopBarRightSection/CompareDataRightSection.jsx:310"}, "properties": {"repobilityId": "63ef42a01fc9bae7", "scanner": "scanner-primary", "fingerprint": "8da0c6e85c5d325e", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/DevelopBarRightSection/CompareDataRightSection.jsx"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-02996f83ab2906bb", "level": "none", "message": {"text": "Commented-code block (17 lines) in frontend/src/sections/develop-detail/AddColumn/AddColumnDrawer.jsx:84"}, "properties": {"repobilityId": "8066e1cf3f41c659", "scanner": "scanner-primary", "fingerprint": "02996f83ab2906bb", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/AddColumn/AddColumnDrawer.jsx"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-c2c3b4bb570d8a84", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/AddColumn/ConditionalNode/validation.js:79"}, "properties": {"repobilityId": "94b92e7f23ff7372", "scanner": "scanner-primary", "fingerprint": "c2c3b4bb570d8a84", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/AddColumn/ConditionalNode/validation.js"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-19b3806223b29adb", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/sections/develop-detail/AddColumn/Retrieval/validation.js:3"}, "properties": {"repobilityId": "89b710f2f06301fc", "scanner": "scanner-primary", "fingerprint": "19b3806223b29adb", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/AddColumn/Retrieval/validation.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-b17d54989a47ca4f", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/sections/develop-detail/DataTab/DevelopData.jsx:955"}, "properties": {"repobilityId": "8cb13795507fa5c2", "scanner": "scanner-primary", "fingerprint": "b17d54989a47ca4f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/DataTab/DevelopData.jsx"}, "region": {"startLine": 955}}}]}, {"ruleId": "scanner-7c207974f2be6b97", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/DataTab/common.js:715"}, "properties": {"repobilityId": "0960777948cb95b1", "scanner": "scanner-primary", "fingerprint": "7c207974f2be6b97", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/DataTab/common.js"}, "region": {"startLine": 715}}}]}, {"ruleId": "scanner-ec4a3ca30472ab2b", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/develop-detail/DataTab/DevelopDataV2.jsx:390"}, "properties": {"repobilityId": "ea3924c8637aa500", "scanner": "scanner-primary", "fingerprint": "ec4a3ca30472ab2b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/DataTab/DevelopDataV2.jsx"}, "region": {"startLine": 390}}}]}, {"ruleId": "scanner-c1284a50cc862a6a", "level": "note", "message": {"text": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/DatasetOptimizationCancelled.jsx:83"}, "properties": {"repobilityId": "2b808d81853e6824", "scanner": "scanner-primary", "fingerprint": "c1284a50cc862a6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a69847cc59ee10b", "level": "note", "message": {"text": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/DatasetOptimizationHeaderComponent.jsx:132"}, "properties": {"repobilityId": "9c1b917b94e35846", "scanner": "scanner-primary", "fingerprint": "7a69847cc59ee10b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-004cd04e1381e115", "level": "note", "message": {"text": "Legacy-named symbol `modelDeprecated` in frontend/src/sections/develop-detail/DatasetOptimization/common.js:80"}, "properties": {"repobilityId": "b9f80478f6970cf1", "scanner": "scanner-primary", "fingerprint": "004cd04e1381e115", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-056f712d56c45f32", "level": "note", "message": {"text": "Legacy-named symbol `ic_stop_v2` in frontend/src/sections/develop-detail/DatasetOptimization/CellRenderers/StatusCellRenderer.jsx:137"}, "properties": {"repobilityId": "c958e5d4f7bcffb0", "scanner": "scanner-primary", "fingerprint": "056f712d56c45f32", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-84d88068a2c9da72", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/sections/develop-detail/DatasetSummaryTab/ChartsContainer/HeatChart.jsx:67"}, "properties": {"repobilityId": "941e51585b673bb7", "scanner": "scanner-primary", "fingerprint": "84d88068a2c9da72", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/develop-detail/DatasetSummaryTab/ChartsContainer/HeatChart.jsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-1598cbc0be327746", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx:330"}, "properties": {"repobilityId": "09a0681f263746da", "scanner": "scanner-primary", "fingerprint": "1598cbc0be327746", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/workbench/createPrompt/WorkbenchProvider.jsx"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-5ab28314bae67c42", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/workbench/createPrompt/promptActions/PromptActions.jsx:322"}, "properties": {"repobilityId": "6b5a1f1c9c47d663", "scanner": "scanner-primary", "fingerprint": "5ab28314bae67c42", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/workbench/createPrompt/promptActions/PromptActions.jsx"}, "region": {"startLine": 322}}}]}, {"ruleId": "scanner-22be1e91be105a55", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/workbench/createPrompt/Playground/OutputSection/SingleResult.jsx:96"}, "properties": {"repobilityId": "ad55a992cccbc358", "scanner": "scanner-primary", "fingerprint": "22be1e91be105a55", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/workbench/createPrompt/Playground/OutputSection/SingleResult.jsx"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-b47b5faeae7d3603", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/Playground/OutputSection/CopyButton.jsx:22"}, "properties": {"repobilityId": "3152ccc0131734b0", "scanner": "scanner-primary", "fingerprint": "b47b5faeae7d3603", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6b79597165a13e78", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/Metrics/MetricEmptyState.jsx:74"}, "properties": {"repobilityId": "52dc83122a0e6e8d", "scanner": "scanner-primary", "fingerprint": "6b79597165a13e78", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0acae331b8d2c249", "level": "none", "message": {"text": "Commented-code block (11 lines) in frontend/src/sections/workbench/createPrompt/Evaluation/EvaluationData/EvaluationData.jsx:338"}, "properties": {"repobilityId": "b95f51e9e92769dd", "scanner": "scanner-primary", "fingerprint": "0acae331b8d2c249", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/workbench/createPrompt/Evaluation/EvaluationData/EvaluationData.jsx"}, "region": {"startLine": 338}}}]}, {"ruleId": "scanner-bfb2cdf4846bb75d", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/workbench/createPrompt/VersionHistory/LabelDropdown/PromptLabel.jsx:139"}, "properties": {"repobilityId": "aa20c3176be070bd", "scanner": "scanner-primary", "fingerprint": "bfb2cdf4846bb75d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8f9cb21384e7fb1e", "level": "note", "message": {"text": "Legacy-named symbol `inferPresetForLegacy` in frontend/src/sections/tasks/TaskCreatePage.jsx:8"}, "properties": {"repobilityId": "6b4b1320d038bc4a", "scanner": "scanner-primary", "fingerprint": "8f9cb21384e7fb1e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9cf620c9c3e1b0c0", "level": "note", "message": {"text": "Legacy-named symbol `convertNewToOld` in frontend/src/sections/tasks/components/TaskFilterBar.jsx:123"}, "properties": {"repobilityId": "ba8f8cdf35dafc8c", "scanner": "scanner-primary", "fingerprint": "9cf620c9c3e1b0c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bfc6854f935734aa", "level": "note", "message": {"text": "Legacy-named symbol `ic_annotation_v2` in frontend/src/sections/annotations/queues/items/queue-items-empty.jsx:28"}, "properties": {"repobilityId": "abef3fe582a49f0c", "scanner": "scanner-primary", "fingerprint": "bfc6854f935734aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-963f4e1387d11643", "level": "note", "message": {"text": "Legacy-named symbol `fetchNextSimulationEvalPageLegacy` in frontend/src/sections/annotations/queues/view/create-rule-dialog.jsx:654"}, "properties": {"repobilityId": "08a60f26815bfe59", "scanner": "scanner-primary", "fingerprint": "963f4e1387d11643", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-948568e327bfdaf0", "level": "note", "message": {"text": "Legacy-named symbol `_buildBlocksFromLegacy` in frontend/src/sections/falcon-ai/store/useFalconStore.js:10"}, "properties": {"repobilityId": "eb97c369bdd460d2", "scanner": "scanner-primary", "fingerprint": "948568e327bfdaf0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9ce2de6e9c21f7b3", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/keys/view/CreateApiKey.jsx:158"}, "properties": {"repobilityId": "fc3c5e559dbfbebb", "scanner": "scanner-primary", "fingerprint": "9ce2de6e9c21f7b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0fb9a2fcba0b84a3", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/keys/view/SecretKeyRenderer.jsx:46"}, "properties": {"repobilityId": "a8cc05cc8b2df545", "scanner": "scanner-primary", "fingerprint": "0fb9a2fcba0b84a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5de344ab91b6df0a", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/src/sections/agents/helper.jsx:254"}, "properties": {"repobilityId": "83ac37cee7909279", "scanner": "scanner-primary", "fingerprint": "5de344ab91b6df0a", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agents/helper.jsx"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-fd62e074b9c7f4f8", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/user/view/user-list-view.jsx:235"}, "properties": {"repobilityId": "206bdc37704fbb40", "scanner": "scanner-primary", "fingerprint": "fd62e074b9c7f4f8", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/user/view/user-list-view.jsx"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-f19cb65327b9cae5", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/sections/evals/EvalsUsageView.jsx:338"}, "properties": {"repobilityId": "a271d64a2b571f64", "scanner": "scanner-primary", "fingerprint": "f19cb65327b9cae5", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/evals/EvalsUsageView.jsx"}, "region": {"startLine": 338}}}]}, {"ruleId": "scanner-00e001ed6e960d7e", "level": "none", "message": {"text": "Commented-code block (11 lines) in frontend/src/sections/evals/EvalDetails/EvalsLog/CellRenderingData.jsx:594"}, "properties": {"repobilityId": "a265778c4cf50e6f", "scanner": "scanner-primary", "fingerprint": "00e001ed6e960d7e", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/evals/EvalDetails/EvalsLog/CellRenderingData.jsx"}, "region": {"startLine": 594}}}]}, {"ruleId": "scanner-812f0a77563010af", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/evals/EvalDetails/EvalsLog/LogsDrawer.jsx:162"}, "properties": {"repobilityId": "f6a126b5078dc7ea", "scanner": "scanner-primary", "fingerprint": "812f0a77563010af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5c7ffe2410ea4bce", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/evals/EvalPlayground/BottomEvaluationSection/BottomEvaluationSection.jsx:164"}, "properties": {"repobilityId": "25aa5a2d4b9a99c4", "scanner": "scanner-primary", "fingerprint": "5c7ffe2410ea4bce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-327754bb962d4d99", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/model/datasets/Datasets.jsx:166"}, "properties": {"repobilityId": "6f41ad0fd9088c4d", "scanner": "scanner-primary", "fingerprint": "327754bb962d4d99", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/datasets/Datasets.jsx"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-6573e307c713c6b1", "level": "none", "message": {"text": "Commented-code block (12 lines) in frontend/src/sections/model/journey/label-studio-component.jsx:25"}, "properties": {"repobilityId": "a99a328b10027b28", "scanner": "scanner-primary", "fingerprint": "6573e307c713c6b1", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/journey/label-studio-component.jsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-3997645dececcdf1", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/model/annotate/annotation-task-table.jsx:74"}, "properties": {"repobilityId": "62a9759802a1ada9", "scanner": "scanner-primary", "fingerprint": "3997645dececcdf1", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/annotate/annotation-task-table.jsx"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-50f3b2eaeae7e8ac", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/sections/model/dataset-detail/DatasetDetailSort.jsx:63"}, "properties": {"repobilityId": "0e08b4af141f0616", "scanner": "scanner-primary", "fingerprint": "50f3b2eaeae7e8ac", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/dataset-detail/DatasetDetailSort.jsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-79337513421ab471", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/model/dataset-detail/DatasetDetail/DatasetDetail.jsx:76"}, "properties": {"repobilityId": "d7c8834c2d1bf7b5", "scanner": "scanner-primary", "fingerprint": "79337513421ab471", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/dataset-detail/DatasetDetail/DatasetDetail.jsx"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-c8d8ff7c3feca13c", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/sections/model/optimize-detail/OptimizeDetailView.jsx:34"}, "properties": {"repobilityId": "2db175c1ad887e42", "scanner": "scanner-primary", "fingerprint": "c8d8ff7c3feca13c", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/optimize-detail/OptimizeDetailView.jsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-4113226c38b2ee75", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/sections/model/optimize/OptimizeDrawer.jsx:81"}, "properties": {"repobilityId": "432bcef13b3a3f4e", "scanner": "scanner-primary", "fingerprint": "4113226c38b2ee75", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/optimize/OptimizeDrawer.jsx"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-f2dd075e38554964", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/model/optimize/OptimizeList.jsx:164"}, "properties": {"repobilityId": "6e3ca08fb86cbf93", "scanner": "scanner-primary", "fingerprint": "f2dd075e38554964", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/model/optimize/OptimizeList.jsx"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-e15d0a6f29ce2f27", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/scenarios/scenario-detail/ScenarioDatasetView.jsx:272"}, "properties": {"repobilityId": "7f3ac7d165fd139c", "scanner": "scanner-primary", "fingerprint": "e15d0a6f29ce2f27", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/scenarios/scenario-detail/ScenarioDatasetView.jsx"}, "region": {"startLine": 272}}}]}, {"ruleId": "scanner-53e5f3af572c51b2", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/agent-playground/AgentPlaygroundView.jsx:44"}, "properties": {"repobilityId": "1dd68752ddcfd784", "scanner": "scanner-primary", "fingerprint": "53e5f3af572c51b2", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agent-playground/AgentPlaygroundView.jsx"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-0691fd835d3fc200", "level": "none", "message": {"text": "Commented-code block (6 lines) in frontend/src/sections/agent-playground/components/FirstTimeExperience.jsx:29"}, "properties": {"repobilityId": "eaf17ee66a29b7fa", "scanner": "scanner-primary", "fingerprint": "0691fd835d3fc200", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agent-playground/components/FirstTimeExperience.jsx"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-48ac95af9dec7b07", "level": "note", "message": {"text": "Legacy-named symbol `ic_copy` in frontend/src/sections/agent-playground/components/ConnectedNodesPanel.jsx:80"}, "properties": {"repobilityId": "08f6c03b32a93dee", "scanner": "scanner-primary", "fingerprint": "48ac95af9dec7b07", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-489c37ffd180728f", "level": "none", "message": {"text": "Commented-code block (10 lines) in frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariableDrawer.jsx:210"}, "properties": {"repobilityId": "2ac19587d394e8b7", "scanner": "scanner-primary", "fingerprint": "489c37ffd180728f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/sections/agent-playground/AgentBuilder/GlobalVariablesPanel/GlobalVariableDrawer.jsx"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-92fcf6ef70bbf709", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/hooks/use-debounced-filter-update.js:28"}, "properties": {"repobilityId": "0414d75fd7ee4a0d", "scanner": "scanner-primary", "fingerprint": "92fcf6ef70bbf709", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/use-debounced-filter-update.js"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-cee0bbc1a2318afb", "level": "none", "message": {"text": "Commented-code block (8 lines) in frontend/src/layouts/dashboard/ProfilePopover.jsx:33"}, "properties": {"repobilityId": "00f338c31c386fac", "scanner": "scanner-primary", "fingerprint": "cee0bbc1a2318afb", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/layouts/dashboard/ProfilePopover.jsx"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-bd09d0ae2e0aff77", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/layouts/dashboard/config-navigation.jsx:98"}, "properties": {"repobilityId": "8e18e3819e10c05c", "scanner": "scanner-primary", "fingerprint": "bd09d0ae2e0aff77", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/layouts/dashboard/config-navigation.jsx"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-57a582f5e6c9a4d6", "level": "warning", "message": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/integrations/temporal/activities.py:671"}, "properties": {"repobilityId": "2a6ed8f4209065aa", "scanner": "scanner-primary", "fingerprint": "57a582f5e6c9a4d6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/integrations/temporal/activities.py"}, "region": {"startLine": 671}}}]}, {"ruleId": "scanner-4d46624c88232354", "level": "note", "message": {"text": "Legacy-named symbol `pubsub_v1` in futureagi/integrations/services/queue_service.py:104"}, "properties": {"repobilityId": "73cb82449ee1fa63", "scanner": "scanner-primary", "fingerprint": "4d46624c88232354", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-61fbefbdb0295a67", "level": "note", "message": {"text": "Legacy-named symbol `experiment_feedback_v2` in futureagi/model_hub/urls.py:98"}, "properties": {"repobilityId": "19508dea3b5c1ac6", "scanner": "scanner-primary", "fingerprint": "61fbefbdb0295a67", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8a245fc68b350a5d", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/model_hub/urls.py:497"}, "properties": {"repobilityId": "ec8dd0e5ed9345dc", "scanner": "scanner-primary", "fingerprint": "8a245fc68b350a5d", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/urls.py"}, "region": {"startLine": 497}}}]}, {"ruleId": "scanner-e1b2713dcd6fc8c4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/model_hub/constants.py:308"}, "properties": {"repobilityId": "355738d440731e47", "scanner": "scanner-primary", "fingerprint": "e1b2713dcd6fc8c4", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/constants.py"}, "region": {"startLine": 308}}}]}, {"ruleId": "scanner-189cf030e4b3571f", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/model_hub/models/annotation_queues.py:323"}, "properties": {"repobilityId": "9602f11d0d9ea733", "scanner": "scanner-primary", "fingerprint": "189cf030e4b3571f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0842bc44a20ffd38", "level": "none", "message": {"text": "Commented-code block (8 lines) in futureagi/model_hub/models/develop_optimisation.py:132"}, "properties": {"repobilityId": "a9a8f40aa3afe4a2", "scanner": "scanner-primary", "fingerprint": "0842bc44a20ffd38", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/models/develop_optimisation.py"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-0358f05155273dcf", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/model_hub/models/choices.py:1355"}, "properties": {"repobilityId": "d8c9ce12997b26d4", "scanner": "scanner-primary", "fingerprint": "0358f05155273dcf", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/models/choices.py"}, "region": {"startLine": 1355}}}]}, {"ruleId": "scanner-a27478f46fe7e78b", "level": "note", "message": {"text": "Legacy-named symbol `allow_copy` in futureagi/model_hub/models/evals_metric.py:158"}, "properties": {"repobilityId": "8016bcd5581b9423", "scanner": "scanner-primary", "fingerprint": "a27478f46fe7e78b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4b8205a87136a736", "level": "warning", "message": {"text": "Likely N+1 query: `for feedback_cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/utils/auto_annotate.py:146"}, "properties": {"repobilityId": "5ca7a7442ebfb9c6", "scanner": "scanner-primary", "fingerprint": "4b8205a87136a736", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/utils/auto_annotate.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-dd6e0ad2c18aafaa", "level": "none", "message": {"text": "Commented-code block (11 lines) in futureagi/model_hub/utils/performance_ch.py:289"}, "properties": {"repobilityId": "f3d483ad8939ccef", "scanner": "scanner-primary", "fingerprint": "dd6e0ad2c18aafaa", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/utils/performance_ch.py"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-868d772279d4ce19", "level": "note", "message": {"text": "Legacy-named symbol `is_v1` in futureagi/model_hub/utils/azure_endpoints.py:85"}, "properties": {"repobilityId": "0611f6f295e346c9", "scanner": "scanner-primary", "fingerprint": "868d772279d4ce19", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2dc18dbbb3b8fa57", "level": "note", "message": {"text": "Legacy-named symbol `scribe_v1` in futureagi/model_hub/utils/utils.py:997"}, "properties": {"repobilityId": "b090aa4614066e67", "scanner": "scanner-primary", "fingerprint": "2dc18dbbb3b8fa57", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a085223a8f27063e", "level": "warning", "message": {"text": "Likely N+1 query: `for evaluator in \u2026` triggers a query per row \u2014 futureagi/model_hub/utils/eval_list.py:254"}, "properties": {"repobilityId": "73e0fd30cc0a6b1e", "scanner": "scanner-primary", "fingerprint": "a085223a8f27063e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/utils/eval_list.py"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-a8cd0fc39140c8d9", "level": "warning", "message": {"text": "Likely N+1 query: `for task in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/experiment_runner.py:208"}, "properties": {"repobilityId": "9dd0632e9f95ef84", "scanner": "scanner-primary", "fingerprint": "a8cd0fc39140c8d9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/experiment_runner.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-467eebfc2c2c889c", "level": "warning", "message": {"text": "Likely N+1 query: `for pending_task in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/experiment_runner.py:286"}, "properties": {"repobilityId": "9cbbf3333906b701", "scanner": "scanner-primary", "fingerprint": "467eebfc2c2c889c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/experiment_runner.py"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-619ed2444787585d", "level": "note", "message": {"text": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/tasks/prompt_template_optimizer.py:14"}, "properties": {"repobilityId": "002ba3e743ec1664", "scanner": "scanner-primary", "fingerprint": "619ed2444787585d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9b105b48be574ad1", "level": "warning", "message": {"text": "Likely N+1 query: `for optimization_obj in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:87"}, "properties": {"repobilityId": "7f932e6be71c26f9", "scanner": "scanner-primary", "fingerprint": "9b105b48be574ad1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/prompt_template_optimizer.py"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-5a87adb13bfb204e", "level": "warning", "message": {"text": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:116"}, "properties": {"repobilityId": "f2f8731ca8799d66", "scanner": "scanner-primary", "fingerprint": "5a87adb13bfb204e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/prompt_template_optimizer.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-9bbaaae201365c85", "level": "warning", "message": {"text": "Likely N+1 query: `for parent_node in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/prompt_template_optimizer.py:678"}, "properties": {"repobilityId": "6f811df09dbb10a7", "scanner": "scanner-primary", "fingerprint": "9bbaaae201365c85", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/prompt_template_optimizer.py"}, "region": {"startLine": 678}}}]}, {"ruleId": "scanner-570d089c24b7fbf7", "level": "note", "message": {"text": "Legacy-named symbol `tags_v2` in futureagi/model_hub/tasks/agent.py:15"}, "properties": {"repobilityId": "9c6b50aa95138bd9", "scanner": "scanner-primary", "fingerprint": "570d089c24b7fbf7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5b80947e05f17aff", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/model_hub/tasks/agent.py:223"}, "properties": {"repobilityId": "5c41e7601aa1a316", "scanner": "scanner-primary", "fingerprint": "5b80947e05f17aff", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/agent.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-1085fac381b05996", "level": "warning", "message": {"text": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/agent.py:129"}, "properties": {"repobilityId": "6ff1853f2445e5cd", "scanner": "scanner-primary", "fingerprint": "1085fac381b05996", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/agent.py"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-985afb0e338cd27f", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/model_hub/tasks/user_evaluation.py:607"}, "properties": {"repobilityId": "a0a1f255fe480dbc", "scanner": "scanner-primary", "fingerprint": "985afb0e338cd27f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/user_evaluation.py"}, "region": {"startLine": 607}}}]}, {"ruleId": "scanner-73b5b0724a64c0ac", "level": "warning", "message": {"text": "Likely N+1 query: `for kb_file in \u2026` triggers a query per row \u2014 futureagi/model_hub/tasks/develop_dataset.py:810"}, "properties": {"repobilityId": "6e024f01f9db669b", "scanner": "scanner-primary", "fingerprint": "73b5b0724a64c0ac", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/tasks/develop_dataset.py"}, "region": {"startLine": 810}}}]}, {"ruleId": "scanner-c913a5acc39aaf52", "level": "note", "message": {"text": "Legacy-named symbol `__plain_backup` in futureagi/model_hub/management/commands/convert_vector_table_to_replicated.py:8"}, "properties": {"repobilityId": "afea4d2e596ee179", "scanner": "scanner-primary", "fingerprint": "c913a5acc39aaf52", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-da12fb99630372ba", "level": "warning", "message": {"text": "Likely N+1 query: `for ta in \u2026` triggers a query per row \u2014 futureagi/model_hub/management/commands/backfill_scores.py:146"}, "properties": {"repobilityId": "fc00c3b59d776678", "scanner": "scanner-primary", "fingerprint": "da12fb99630372ba", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/management/commands/backfill_scores.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-f7e6dc7bfe3bcee7", "level": "warning", "message": {"text": "Likely N+1 query: `for ia in \u2026` triggers a query per row \u2014 futureagi/model_hub/management/commands/backfill_scores.py:234"}, "properties": {"repobilityId": "f8866e81611e9cf3", "scanner": "scanner-primary", "fingerprint": "f7e6dc7bfe3bcee7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/management/commands/backfill_scores.py"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-0a0e8bce208164cd", "level": "note", "message": {"text": "Legacy-named symbol `allow_copy` in futureagi/model_hub/management/commands/seed_system_evals.py:198"}, "properties": {"repobilityId": "6f14fbe4b35f1913", "scanner": "scanner-primary", "fingerprint": "0a0e8bce208164cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c9c0b763b2cd96cb", "level": "note", "message": {"text": "Legacy-named symbol `model_deprecated` in futureagi/model_hub/serializers/dataset_optimization.py:317"}, "properties": {"repobilityId": "cf122f9deb76cafe", "scanner": "scanner-primary", "fingerprint": "c9c0b763b2cd96cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e0ff0016f5a302c2", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/model_hub/serializers/run_prompt.py:274"}, "properties": {"repobilityId": "09dffa9c927dc17b", "scanner": "scanner-primary", "fingerprint": "e0ff0016f5a302c2", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/serializers/run_prompt.py"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-917a79793461b422", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/model_hub/serializers/develop_optimisation.py:97"}, "properties": {"repobilityId": "b9e75d6b2bc681d1", "scanner": "scanner-primary", "fingerprint": "917a79793461b422", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/serializers/develop_optimisation.py"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-ca2b00ae759cde15", "level": "warning", "message": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/serializers/develop_annotations.py:315"}, "properties": {"repobilityId": "e9b400dad43de8c7", "scanner": "scanner-primary", "fingerprint": "ca2b00ae759cde15", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/serializers/develop_annotations.py"}, "region": {"startLine": 315}}}]}, {"ruleId": "scanner-c7d7d5350ab59aab", "level": "warning", "message": {"text": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/model_hub/services/annotation_summary_service.py:150"}, "properties": {"repobilityId": "98d2cbcbcbdcd64f", "scanner": "scanner-primary", "fingerprint": "c7d7d5350ab59aab", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/services/annotation_summary_service.py"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-df9592f3f79ca31e", "level": "note", "message": {"text": "Legacy-named symbol `tokenbf_v1` in futureagi/model_hub/services/legacy_ch_tables.py:156"}, "properties": {"repobilityId": "4316699f99766334", "scanner": "scanner-primary", "fingerprint": "df9592f3f79ca31e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4fa7e12a804cc0f0", "level": "warning", "message": {"text": "Likely N+1 query: `for annot in \u2026` triggers a query per row \u2014 futureagi/model_hub/services/dataset_validators.py:175"}, "properties": {"repobilityId": "862904004c811b34", "scanner": "scanner-primary", "fingerprint": "4fa7e12a804cc0f0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/services/dataset_validators.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-a3d976c312d3a657", "level": "warning", "message": {"text": "Likely N+1 query: `for ta in \u2026` triggers a query per row \u2014 futureagi/model_hub/migrations/0062_ttsvoice_score.py:95"}, "properties": {"repobilityId": "79e8c4206cc13c27", "scanner": "scanner-primary", "fingerprint": "a3d976c312d3a657", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/migrations/0062_ttsvoice_score.py"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-263157ead2ac4c4f", "level": "note", "message": {"text": "Legacy-named symbol `allow_copy` in futureagi/model_hub/migrations/0079_eval_permissions_fields.py:1"}, "properties": {"repobilityId": "4416893559fbe5bc", "scanner": "scanner-primary", "fingerprint": "263157ead2ac4c4f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4841564cddad1b80", "level": "note", "message": {"text": "Legacy-named symbol `is_v2` in futureagi/model_hub/views/experiments.py:955"}, "properties": {"repobilityId": "601fef51403fa238", "scanner": "scanner-primary", "fingerprint": "4841564cddad1b80", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e75479bb2e476dee", "level": "warning", "message": {"text": "Likely N+1 query: `for column in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiments.py:2079"}, "properties": {"repobilityId": "fff950ef57757a19", "scanner": "scanner-primary", "fingerprint": "e75479bb2e476dee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/experiments.py"}, "region": {"startLine": 2079}}}]}, {"ruleId": "scanner-cce62c5234f5a577", "level": "warning", "message": {"text": "Likely N+1 query: `for exp_dataset in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiments.py:2117"}, "properties": {"repobilityId": "19f68c8c8c44cf73", "scanner": "scanner-primary", "fingerprint": "cce62c5234f5a577", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/experiments.py"}, "region": {"startLine": 2117}}}]}, {"ruleId": "scanner-e343e243dd515f58", "level": "warning", "message": {"text": "Likely N+1 query: `for thread_comment in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/annotation_queues.py:878"}, "properties": {"repobilityId": "f661431ba55b95ce", "scanner": "scanner-primary", "fingerprint": "e343e243dd515f58", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/annotation_queues.py"}, "region": {"startLine": 878}}}]}, {"ruleId": "scanner-bf0cbf50795c6631", "level": "note", "message": {"text": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/views/optimize_dataset.py:20"}, "properties": {"repobilityId": "282f2ae6b03a2289", "scanner": "scanner-primary", "fingerprint": "bf0cbf50795c6631", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-620a067f1ff0a3ec", "level": "note", "message": {"text": "Legacy-named symbol `config_copy` in futureagi/model_hub/views/eval_runner.py:2134"}, "properties": {"repobilityId": "5e2b61ac0dd2cfdf", "scanner": "scanner-primary", "fingerprint": "620a067f1ff0a3ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f564ecbd97d40c73", "level": "warning", "message": {"text": "Likely N+1 query: `for user_eval_metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiment_runner.py:825"}, "properties": {"repobilityId": "2a6ac4d0d40439f2", "scanner": "scanner-primary", "fingerprint": "f564ecbd97d40c73", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/experiment_runner.py"}, "region": {"startLine": 825}}}]}, {"ruleId": "scanner-8b5e64f753267ce4", "level": "warning", "message": {"text": "Likely N+1 query: `for eval_template in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/eval_group.py:248"}, "properties": {"repobilityId": "0fe8a80f9299b4e7", "scanner": "scanner-primary", "fingerprint": "8b5e64f753267ce4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/eval_group.py"}, "region": {"startLine": 248}}}]}, {"ruleId": "scanner-7f0c6ee926d87286", "level": "warning", "message": {"text": "Likely N+1 query: `for conversation in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/performance.py:328"}, "properties": {"repobilityId": "390fa69a4a0e9135", "scanner": "scanner-primary", "fingerprint": "7f0c6ee926d87286", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/performance.py"}, "region": {"startLine": 328}}}]}, {"ruleId": "scanner-0478100c29979dfb", "level": "warning", "message": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/experiment_feedback_v2.py:392"}, "properties": {"repobilityId": "e03975abe7101236", "scanner": "scanner-primary", "fingerprint": "0478100c29979dfb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/experiment_feedback_v2.py"}, "region": {"startLine": 392}}}]}, {"ruleId": "scanner-f38edf3549b48299", "level": "none", "message": {"text": "Commented-code block (16 lines) in futureagi/model_hub/views/run_prompt.py:1509"}, "properties": {"repobilityId": "07c7f1cbf5ea9251", "scanner": "scanner-primary", "fingerprint": "f38edf3549b48299", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/run_prompt.py"}, "region": {"startLine": 1509}}}]}, {"ruleId": "scanner-1417c0f37079ffc9", "level": "none", "message": {"text": "Commented-code block (8 lines) in futureagi/model_hub/views/metric.py:165"}, "properties": {"repobilityId": "d9ed692c21e31093", "scanner": "scanner-primary", "fingerprint": "1417c0f37079ffc9", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/metric.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-1da9d32fccba7320", "level": "note", "message": {"text": "Legacy-named symbol `agent_task_v2` in futureagi/model_hub/views/develop_optimiser.py:16"}, "properties": {"repobilityId": "72a357799cfb8b49", "scanner": "scanner-primary", "fingerprint": "1da9d32fccba7320", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-782057a808093517", "level": "none", "message": {"text": "Commented-code block (7 lines) in futureagi/model_hub/views/develop_optimiser.py:477"}, "properties": {"repobilityId": "5a0b80a5d23ad2b7", "scanner": "scanner-primary", "fingerprint": "782057a808093517", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/develop_optimiser.py"}, "region": {"startLine": 477}}}]}, {"ruleId": "scanner-0885513342a15678", "level": "warning", "message": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_optimiser.py:93"}, "properties": {"repobilityId": "43b49b3ea2cc97c9", "scanner": "scanner-primary", "fingerprint": "0885513342a15678", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/develop_optimiser.py"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-769df1f78df3fce6", "level": "warning", "message": {"text": "Likely N+1 query: `for label in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_annotations.py:251"}, "properties": {"repobilityId": "e33d439c1a61f956", "scanner": "scanner-primary", "fingerprint": "769df1f78df3fce6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/develop_annotations.py"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-4ec92cf683b1d7d6", "level": "note", "message": {"text": "Legacy-named symbol `config_copy` in futureagi/model_hub/views/custom_model.py:255"}, "properties": {"repobilityId": "1618afa9b6dc1d99", "scanner": "scanner-primary", "fingerprint": "4ec92cf683b1d7d6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b2bf9b2af173a42a", "level": "warning", "message": {"text": "Likely N+1 query: `for ov in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/prompt_labels.py:308"}, "properties": {"repobilityId": "357f6c73bb145e40", "scanner": "scanner-primary", "fingerprint": "b2bf9b2af173a42a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/prompt_labels.py"}, "region": {"startLine": 308}}}]}, {"ruleId": "scanner-9318ae0f47773d5e", "level": "warning", "message": {"text": "Likely N+1 query: `for note in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/scores.py:816"}, "properties": {"repobilityId": "284420c6cf27ae0d", "scanner": "scanner-primary", "fingerprint": "9318ae0f47773d5e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/scores.py"}, "region": {"startLine": 816}}}]}, {"ruleId": "scanner-c334262233e9b404", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/model_hub/views/prompt_template.py:962"}, "properties": {"repobilityId": "111a449aaf61c8d1", "scanner": "scanner-primary", "fingerprint": "c334262233e9b404", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/prompt_template.py"}, "region": {"startLine": 962}}}]}, {"ruleId": "scanner-83c1ab6343ac7f44", "level": "warning", "message": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/prompt_template.py:2130"}, "properties": {"repobilityId": "17260310c9b71753", "scanner": "scanner-primary", "fingerprint": "83c1ab6343ac7f44", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/prompt_template.py"}, "region": {"startLine": 2130}}}]}, {"ruleId": "scanner-dda1f3d315b386c4", "level": "none", "message": {"text": "Commented-code block (8 lines) in futureagi/model_hub/views/develop_dataset.py:993"}, "properties": {"repobilityId": "b948aae8db1d77a6", "scanner": "scanner-primary", "fingerprint": "dda1f3d315b386c4", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/develop_dataset.py"}, "region": {"startLine": 993}}}]}, {"ruleId": "scanner-332c095682694b59", "level": "warning", "message": {"text": "Likely N+1 query: `for column in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/develop_dataset.py:1631"}, "properties": {"repobilityId": "28363a3facda5adc", "scanner": "scanner-primary", "fingerprint": "332c095682694b59", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/develop_dataset.py"}, "region": {"startLine": 1631}}}]}, {"ruleId": "scanner-33c4cd535996d4a6", "level": "note", "message": {"text": "Stub function `_handle_upload_file` (body is just `pass`/`return`) \u2014 futureagi/model_hub/views/develop_dataset.py:5908"}, "properties": {"repobilityId": "fd8e166971c70ead", "scanner": "scanner-primary", "fingerprint": "33c4cd535996d4a6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-9e46bde641bf08db", "level": "note", "message": {"text": "Legacy-named symbol `fields_to_copy` in futureagi/model_hub/views/separate_evals.py:7885"}, "properties": {"repobilityId": "d29f6cd7f61fe9eb", "scanner": "scanner-primary", "fingerprint": "9e46bde641bf08db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e594d4ce61cc76c3", "level": "warning", "message": {"text": "Likely N+1 query: `for v in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/separate_evals.py:2561"}, "properties": {"repobilityId": "261474e67d0ca7af", "scanner": "scanner-primary", "fingerprint": "e594d4ce61cc76c3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/separate_evals.py"}, "region": {"startLine": 2561}}}]}, {"ruleId": "scanner-6f8a39793d44c86e", "level": "warning", "message": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/datasets/add_rows/existing_dataset.py:239"}, "properties": {"repobilityId": "9d24d721d2f24c3c", "scanner": "scanner-primary", "fingerprint": "6f8a39793d44c86e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/datasets/add_rows/existing_dataset.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-9d96ed48d59f0d8f", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/model_hub/views/datasets/add_rows/huggingface.py:260"}, "properties": {"repobilityId": "38de3c448f55385f", "scanner": "scanner-primary", "fingerprint": "9d96ed48d59f0d8f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/datasets/add_rows/huggingface.py"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-b37bfacd20dc7d69", "level": "warning", "message": {"text": "Likely N+1 query: `for metric in \u2026` triggers a query per row \u2014 futureagi/model_hub/views/datasets/create/dataset_from_experiment.py:304"}, "properties": {"repobilityId": "96c44bed793bbbf3", "scanner": "scanner-primary", "fingerprint": "b37bfacd20dc7d69", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/datasets/create/dataset_from_experiment.py"}, "region": {"startLine": 304}}}]}, {"ruleId": "scanner-e7b689c7f21d2e38", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/model_hub/views/utils/evals.py:736"}, "properties": {"repobilityId": "b488aa9e6e6dfcdd", "scanner": "scanner-primary", "fingerprint": "e7b689c7f21d2e38", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/utils/evals.py"}, "region": {"startLine": 736}}}]}, {"ruleId": "scanner-3338aaf60c61316a", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/simulate/admin.py:9"}, "properties": {"repobilityId": "d0ccdbd6ff7cbc77", "scanner": "scanner-primary", "fingerprint": "3338aaf60c61316a", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/admin.py"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-ceb0140579ad899c", "level": "note", "message": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/models/agent_definition.py:265"}, "properties": {"repobilityId": "eb8ce40e39746231", "scanner": "scanner-primary", "fingerprint": "ceb0140579ad899c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3a963e82935fa106", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/simulate/constants/installation_guide.py:22"}, "properties": {"repobilityId": "899e2e5f390115eb", "scanner": "scanner-primary", "fingerprint": "3a963e82935fa106", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/constants/installation_guide.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-6cc485ede76301ea", "level": "warning", "message": {"text": "Likely N+1 query: `for t in \u2026` triggers a query per row \u2014 futureagi/simulate/utils/agent_optimiser.py:1036"}, "properties": {"repobilityId": "82cad6e8f6da3887", "scanner": "scanner-primary", "fingerprint": "6cc485ede76301ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/utils/agent_optimiser.py"}, "region": {"startLine": 1036}}}]}, {"ruleId": "scanner-13b08bfb61faddad", "level": "warning", "message": {"text": "Likely N+1 query: `for ce in \u2026` triggers a query per row \u2014 futureagi/simulate/tasks/chat_sim.py:574"}, "properties": {"repobilityId": "7f2b7233a9efeba5", "scanner": "scanner-primary", "fingerprint": "13b08bfb61faddad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/tasks/chat_sim.py"}, "region": {"startLine": 574}}}]}, {"ruleId": "scanner-93c5a1c8b1dd4516", "level": "none", "message": {"text": "Commented-code block (8 lines) in futureagi/simulate/temporal/client.py:279"}, "properties": {"repobilityId": "0f402d287359b47c", "scanner": "scanner-primary", "fingerprint": "93c5a1c8b1dd4516", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/temporal/client.py"}, "region": {"startLine": 279}}}]}, {"ruleId": "scanner-aff451045ae9d210", "level": "note", "message": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/temporal/activities/xl.py:443"}, "properties": {"repobilityId": "9b90fbc105e648bd", "scanner": "scanner-primary", "fingerprint": "aff451045ae9d210", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a9816d630069174d", "level": "none", "message": {"text": "Commented-code block (8 lines) in futureagi/simulate/serializers/persona.py:374"}, "properties": {"repobilityId": "0f1a40f7e5cb023b", "scanner": "scanner-primary", "fingerprint": "a9816d630069174d", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/serializers/persona.py"}, "region": {"startLine": 374}}}]}, {"ruleId": "scanner-7d2e893a4decd070", "level": "note", "message": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/services/agent_definition.py:86"}, "properties": {"repobilityId": "23004230a2440a90", "scanner": "scanner-primary", "fingerprint": "7d2e893a4decd070", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-38981a7d8d972e13", "level": "note", "message": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/services/hosted_runner.py:864"}, "properties": {"repobilityId": "0f364fbe5cbbfdc2", "scanner": "scanner-primary", "fingerprint": "38981a7d8d972e13", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-24386336244c2791", "level": "note", "message": {"text": "Legacy-named symbol `_create_persona_scenarios_legacy` in futureagi/simulate/services/alk_simulate_ingestion.py:427"}, "properties": {"repobilityId": "4036f9a4e9119b5c", "scanner": "scanner-primary", "fingerprint": "24386336244c2791", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-01073cfb1c543e94", "level": "note", "message": {"text": "Legacy-named symbol `datadir_copy` in futureagi/simulate/services/hosted_harness_gateway.py:57"}, "properties": {"repobilityId": "a9fa659d188502ed", "scanner": "scanner-primary", "fingerprint": "01073cfb1c543e94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f0a64e9c46e650ae", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/simulate/services/hosted_harness_gateway.py:362"}, "properties": {"repobilityId": "6ca522d4dcfc4b1d", "scanner": "scanner-primary", "fingerprint": "f0a64e9c46e650ae", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/services/hosted_harness_gateway.py"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-b944b5036c28f942", "level": "warning", "message": {"text": "Likely N+1 query: `for creds in \u2026` triggers a query per row \u2014 futureagi/simulate/migrations/0076_backfill_provider_credentials.py:48"}, "properties": {"repobilityId": "f8d455da375b9c81", "scanner": "scanner-primary", "fingerprint": "b944b5036c28f942", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/migrations/0076_backfill_provider_credentials.py"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-6ca760df484342d5", "level": "note", "message": {"text": "Legacy-named symbol `credentials_legacy` in futureagi/simulate/migrations/0075_add_agent_version_to_provider_credentials.py:22"}, "properties": {"repobilityId": "d5bf1083ac34e180", "scanner": "scanner-primary", "fingerprint": "6ca760df484342d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-83e784a2c718d299", "level": "none", "message": {"text": "Commented-code block (8 lines) in futureagi/simulate/views/scenarios.py:938"}, "properties": {"repobilityId": "8e6bd17bef45a359", "scanner": "scanner-primary", "fingerprint": "83e784a2c718d299", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/scenarios.py"}, "region": {"startLine": 938}}}]}, {"ruleId": "scanner-c3849c1aa49d8cfc", "level": "none", "message": {"text": "Commented-code block (13 lines) in futureagi/simulate/views/call_transcript.py:218"}, "properties": {"repobilityId": "5895d970b50db2d5", "scanner": "scanner-primary", "fingerprint": "c3849c1aa49d8cfc", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/call_transcript.py"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-38823ded62dc1fbf", "level": "warning", "message": {"text": "Likely N+1 query: `for call_execution in \u2026` triggers a query per row \u2014 futureagi/simulate/views/call_transcript.py:139"}, "properties": {"repobilityId": "04f4e8ec1fb23499", "scanner": "scanner-primary", "fingerprint": "38823ded62dc1fbf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/call_transcript.py"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-d867681760cfdd41", "level": "warning", "message": {"text": "Likely N+1 query: `for item in \u2026` triggers a query per row \u2014 futureagi/simulate/views/agent_prompt_optimiser.py:585"}, "properties": {"repobilityId": "25e02f85da949edf", "scanner": "scanner-primary", "fingerprint": "d867681760cfdd41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/agent_prompt_optimiser.py"}, "region": {"startLine": 585}}}]}, {"ruleId": "scanner-445fd5d34e794319", "level": "warning", "message": {"text": "Likely N+1 query: `for gcp_account in \u2026` triggers a query per row \u2014 futureagi/accounts/gcp_marketplace_utils.py:356"}, "properties": {"repobilityId": "f15950245c44aac0", "scanner": "scanner-primary", "fingerprint": "445fd5d34e794319", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/gcp_marketplace_utils.py"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-1cd36b1a357328a3", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/accounts/user_onboard.py:1139"}, "properties": {"repobilityId": "3769cac739028a0c", "scanner": "scanner-primary", "fingerprint": "1cd36b1a357328a3", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/user_onboard.py"}, "region": {"startLine": 1139}}}]}, {"ruleId": "scanner-6e198f53d1f5c11f", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/utils.py:659"}, "properties": {"repobilityId": "85b086d071304aa7", "scanner": "scanner-primary", "fingerprint": "6e198f53d1f5c11f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6bc4112c1a3dd3c0", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/organization_membership.py:74"}, "properties": {"repobilityId": "0a97049a243553f0", "scanner": "scanner-primary", "fingerprint": "6bc4112c1a3dd3c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-425257584c57f982", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/workspace.py:104"}, "properties": {"repobilityId": "3ef0a06e1d827c7c", "scanner": "scanner-primary", "fingerprint": "425257584c57f982", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ef32876bb624453c", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/models/user.py:133"}, "properties": {"repobilityId": "80f59203485f337a", "scanner": "scanner-primary", "fingerprint": "ef32876bb624453c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b085c5f209e29c7c", "level": "warning", "message": {"text": "Likely N+1 query: `for row in \u2026` triggers a query per row \u2014 futureagi/accounts/management/commands/export_gcp_marketplace_usage.py:84"}, "properties": {"repobilityId": "fb9c1ff9b0e09900", "scanner": "scanner-primary", "fingerprint": "b085c5f209e29c7c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/management/commands/export_gcp_marketplace_usage.py"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-84890f6b8b2b4354", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/services/workspace_members.py:121"}, "properties": {"repobilityId": "64c568c6bf22ec9e", "scanner": "scanner-primary", "fingerprint": "84890f6b8b2b4354", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4be96504de0dce16", "level": "warning", "message": {"text": "Likely N+1 query: `for ws_mem in \u2026` triggers a query per row \u2014 futureagi/accounts/services/workspace_members.py:125"}, "properties": {"repobilityId": "68d7e04bd16e0fa6", "scanner": "scanner-primary", "fingerprint": "4be96504de0dce16", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/services/workspace_members.py"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-1bceac384be06d99", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/services/member_role_service.py:220"}, "properties": {"repobilityId": "646d2edc10f22c9b", "scanner": "scanner-primary", "fingerprint": "1bceac384be06d99", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bd9626b9229246d2", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/accounts/services/gcp_procurement.py:146"}, "properties": {"repobilityId": "b52e60372ffb9f93", "scanner": "scanner-primary", "fingerprint": "bd9626b9229246d2", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/services/gcp_procurement.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-0b46060d2bc87c5f", "level": "note", "message": {"text": "Stub function `noop` (body is just `pass`/`return`) \u2014 futureagi/accounts/migrations/0022_backfill_ws_org_membership_fk.py:67"}, "properties": {"repobilityId": "cdb7d4bd7220677c", "scanner": "scanner-primary", "fingerprint": "0b46060d2bc87c5f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-ffdf701d2d6fbc6f", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/rbac_views.py:118"}, "properties": {"repobilityId": "36b108f09b663721", "scanner": "scanner-primary", "fingerprint": "ffdf701d2d6fbc6f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c5d86e3e33e6faba", "level": "warning", "message": {"text": "Likely N+1 query: `for mem in \u2026` triggers a query per row \u2014 futureagi/accounts/views/rbac_views.py:677"}, "properties": {"repobilityId": "be65d23b3a17d071", "scanner": "scanner-primary", "fingerprint": "c5d86e3e33e6faba", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/rbac_views.py"}, "region": {"startLine": 677}}}]}, {"ruleId": "scanner-5336b30126f3229d", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/signup.py:937"}, "properties": {"repobilityId": "ac9a11ccfdc38294", "scanner": "scanner-primary", "fingerprint": "5336b30126f3229d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0b90771b957ccaee", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/accounts/views/workspace.py:287"}, "properties": {"repobilityId": "9c6034490d68af1e", "scanner": "scanner-primary", "fingerprint": "0b90771b957ccaee", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/workspace.py"}, "region": {"startLine": 287}}}]}, {"ruleId": "scanner-b449cb82824a3079", "level": "warning", "message": {"text": "Likely N+1 query: `for workspace in \u2026` triggers a query per row \u2014 futureagi/accounts/views/workspace.py:108"}, "properties": {"repobilityId": "ccfe8e305969c6ab", "scanner": "scanner-primary", "fingerprint": "b449cb82824a3079", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/workspace.py"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-02b139e1cf896dc3", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/organization_selection.py:125"}, "properties": {"repobilityId": "3022cbc477f78ebb", "scanner": "scanner-primary", "fingerprint": "02b139e1cf896dc3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-176fd36869cf349e", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/workspace_management.py:265"}, "properties": {"repobilityId": "7942a5ebdcae7c58", "scanner": "scanner-primary", "fingerprint": "176fd36869cf349e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-66a5a2df4a94621b", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/accounts/views/workspace_management.py:2178"}, "properties": {"repobilityId": "0e7c4e2402ac17c7", "scanner": "scanner-primary", "fingerprint": "66a5a2df4a94621b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/workspace_management.py"}, "region": {"startLine": 2178}}}]}, {"ruleId": "scanner-ff42d4d733418935", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/accounts/views/user.py:838"}, "properties": {"repobilityId": "05af5ef81d9837b1", "scanner": "scanner-primary", "fingerprint": "ff42d4d733418935", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4fb24beb40ea08d0", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentcc/services/email_sender.py:115"}, "properties": {"repobilityId": "f714d3638c370906", "scanner": "scanner-primary", "fingerprint": "4fb24beb40ea08d0", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentcc/services/email_sender.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-097830394b8d3f4a", "level": "note", "message": {"text": "Legacy-named symbol `check_copy` in futureagi/agentcc/views/org_config.py:117"}, "properties": {"repobilityId": "515a7489b5f63628", "scanner": "scanner-primary", "fingerprint": "097830394b8d3f4a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3eed387c72b8bac1", "level": "note", "message": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tfc/settings/settings.py:2131"}, "properties": {"repobilityId": "879e086254b815c4", "scanner": "scanner-primary", "fingerprint": "3eed387c72b8bac1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0135d27db10891ce", "level": "warning", "message": {"text": "Likely N+1 query: `for cell in \u2026` triggers a query per row \u2014 futureagi/tfc/utils/functions.py:518"}, "properties": {"repobilityId": "60eff09c496f82dc", "scanner": "scanner-primary", "fingerprint": "0135d27db10891ce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/utils/functions.py"}, "region": {"startLine": 518}}}]}, {"ruleId": "scanner-19ee38bb9dfc8cae", "level": "note", "message": {"text": "Stub function `load_model` (body is just `pass`/`return`) \u2014 futureagi/tfc/utils/distributed_locks.py:475"}, "properties": {"repobilityId": "1f132460f19dbfe3", "scanner": "scanner-primary", "fingerprint": "19ee38bb9dfc8cae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-f109e13dfa591f75", "level": "none", "message": {"text": "Commented-code block (13 lines) in futureagi/tfc/utils/storage.py:940"}, "properties": {"repobilityId": "65edcbead81b7c86", "scanner": "scanner-primary", "fingerprint": "f109e13dfa591f75", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/utils/storage.py"}, "region": {"startLine": 940}}}]}, {"ruleId": "scanner-9c478969df839e3b", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/tfc/utils/clickhouse.py:161"}, "properties": {"repobilityId": "3ef3fd965bfb1989", "scanner": "scanner-primary", "fingerprint": "9c478969df839e3b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/utils/clickhouse.py"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-f3a5d338e652cf22", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/tfc/utils/validations.py:174"}, "properties": {"repobilityId": "49ef9cc670d88314", "scanner": "scanner-primary", "fingerprint": "f3a5d338e652cf22", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/utils/validations.py"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-a2e83be08c339f3e", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/tfc/utils/distributed_examples.py:24"}, "properties": {"repobilityId": "9f8a9e9b2519fb91", "scanner": "scanner-primary", "fingerprint": "a2e83be08c339f3e", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/utils/distributed_examples.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-e161ea26a5abb259", "level": "note", "message": {"text": "Legacy-named symbol `pubsub_v1` in futureagi/tfc/temporal/marketplace/activities.py:60"}, "properties": {"repobilityId": "729fbaba2d9ecb83", "scanner": "scanner-primary", "fingerprint": "e161ea26a5abb259", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6657d9e87ae89ced", "level": "note", "message": {"text": "Stub function `_noop_worker_loop` (body is just `pass`/`return`) \u2014 futureagi/tfc/temporal/common/worker.py:83"}, "properties": {"repobilityId": "ca9c18d1fc35300f", "scanner": "scanner-primary", "fingerprint": "6657d9e87ae89ced", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-755bd08da6b346f3", "level": "none", "message": {"text": "Commented-code block (11 lines) in futureagi/tfc/temporal/schedules/tracer.py:18"}, "properties": {"repobilityId": "c50ab5ecfa989562", "scanner": "scanner-primary", "fingerprint": "755bd08da6b346f3", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/temporal/schedules/tracer.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-fc00d2c1a484fff7", "level": "none", "message": {"text": "Commented-code block (14 lines) in futureagi/tfc/temporal/schedules/simulate.py:14"}, "properties": {"repobilityId": "b3bfb3de00257d4c", "scanner": "scanner-primary", "fingerprint": "fc00d2c1a484fff7", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/temporal/schedules/simulate.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-905743918995fe9a", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def check_status` \u2014 futureagi/tfc/management/commands/debug_temporal.py:180"}, "properties": {"repobilityId": "61b3c4abaa586984", "scanner": "scanner-primary", "fingerprint": "905743918995fe9a", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/management/commands/debug_temporal.py"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-f00c7c32644c24aa", "level": "note", "message": {"text": "Stub function `_noop` (body is just `pass`/`return`) \u2014 futureagi/tfc/management/commands/start_temporal_worker.py:159"}, "properties": {"repobilityId": "bb041dd27056714f", "scanner": "scanner-primary", "fingerprint": "f00c7c32644c24aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-8475b6794e33902d", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/tfc/permissions/utils.py:54"}, "properties": {"repobilityId": "172b6191e133d514", "scanner": "scanner-primary", "fingerprint": "8475b6794e33902d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5062646086de14d0", "level": "note", "message": {"text": "Legacy-named symbol `level_or_legacy` in futureagi/tfc/permissions/rbac.py:38"}, "properties": {"repobilityId": "7237a5b1d27050e8", "scanner": "scanner-primary", "fingerprint": "5062646086de14d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-601be0bdd0c1e466", "level": "note", "message": {"text": "Legacy-named symbol `explore_trace_legacy` in futureagi/ai_tools/tools/__init__.py:228"}, "properties": {"repobilityId": "2040e1a9fbe8288e", "scanner": "scanner-primary", "fingerprint": "601be0bdd0c1e466", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-47c21fb817822df6", "level": "warning", "message": {"text": "Likely N+1 query: `for em in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/datasets/run_dataset_evals.py:83"}, "properties": {"repobilityId": "eaa26813c0793a2b", "scanner": "scanner-primary", "fingerprint": "47c21fb817822df6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/datasets/run_dataset_evals.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-abfe4c0bcf79214b", "level": "warning", "message": {"text": "Likely N+1 query: `for wm in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/users/get_user.py:73"}, "properties": {"repobilityId": "88aa647d27ab4ec2", "scanner": "scanner-primary", "fingerprint": "abfe4c0bcf79214b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/users/get_user.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-86abed966b35249c", "level": "warning", "message": {"text": "Likely N+1 query: `for test_execution in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/simulation/rerun_test_execution.py:266"}, "properties": {"repobilityId": "064f2aa229e71098", "scanner": "scanner-primary", "fingerprint": "86abed966b35249c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/simulation/rerun_test_execution.py"}, "region": {"startLine": 266}}}]}, {"ruleId": "scanner-faafbe4a0633fedc", "level": "warning", "message": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/simulation/get_call_logs.py:88"}, "properties": {"repobilityId": "29cdcb108cf2746f", "scanner": "scanner-primary", "fingerprint": "faafbe4a0633fedc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/simulation/get_call_logs.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-2bd500def10372fc", "level": "warning", "message": {"text": "Likely N+1 query: `for ann in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/annotations/list_annotations.py:54"}, "properties": {"repobilityId": "fd95c56befe1f8d0", "scanner": "scanner-primary", "fingerprint": "2bd500def10372fc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/annotations/list_annotations.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-4259f6bfa10faedd", "level": "warning", "message": {"text": "Likely N+1 query: `for lbl in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/annotations/get_annotation.py:80"}, "properties": {"repobilityId": "853108a41a1ad580", "scanner": "scanner-primary", "fingerprint": "4259f6bfa10faedd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/annotations/get_annotation.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-cb28d0a9ad1a5292", "level": "note", "message": {"text": "Legacy-named symbol `fields_to_copy` in futureagi/ai_tools/tools/evaluations/duplicate_eval_template.py:92"}, "properties": {"repobilityId": "f509036bb897202e", "scanner": "scanner-primary", "fingerprint": "cb28d0a9ad1a5292", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-895a408bcc6f9a91", "level": "warning", "message": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/get_eval_logs.py:105"}, "properties": {"repobilityId": "b560fd3cf13e1b62", "scanner": "scanner-primary", "fingerprint": "895a408bcc6f9a91", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/evaluations/get_eval_logs.py"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-449549b18ef75163", "level": "warning", "message": {"text": "Likely N+1 query: `for ev in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/list_evaluations.py:66"}, "properties": {"repobilityId": "f2d1aebf24e55109", "scanner": "scanner-primary", "fingerprint": "449549b18ef75163", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/evaluations/list_evaluations.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-a40bcbfff570874c", "level": "warning", "message": {"text": "Likely N+1 query: `for g in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/evaluations/list_eval_groups.py:52"}, "properties": {"repobilityId": "f7c894c6fe8a3b02", "scanner": "scanner-primary", "fingerprint": "a40bcbfff570874c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/evaluations/list_eval_groups.py"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-14b8e8a03ed8b4a0", "level": "warning", "message": {"text": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/agents/list_scenarios.py:78"}, "properties": {"repobilityId": "c41de376d572dd7f", "scanner": "scanner-primary", "fingerprint": "14b8e8a03ed8b4a0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/agents/list_scenarios.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-9610d9a1610945bc", "level": "warning", "message": {"text": "Likely N+1 query: `for e in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/get_eval_task.py:50"}, "properties": {"repobilityId": "20ed438570389d02", "scanner": "scanner-primary", "fingerprint": "9610d9a1610945bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/tracing/get_eval_task.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-87af4fbd8dd52c4c", "level": "warning", "message": {"text": "Likely N+1 query: `for task in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_eval_tasks.py:85"}, "properties": {"repobilityId": "cd8b15895315f541", "scanner": "scanner-primary", "fingerprint": "87af4fbd8dd52c4c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/tracing/list_eval_tasks.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-307086aabfc7d195", "level": "warning", "message": {"text": "Likely N+1 query: `for trace in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/search_traces.py:74"}, "properties": {"repobilityId": "2c6dbbc856162a31", "scanner": "scanner-primary", "fingerprint": "307086aabfc7d195", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/tracing/search_traces.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-b9d510c018a1ecaa", "level": "note", "message": {"text": "Legacy-named symbol `explore_trace_legacy` in futureagi/ai_tools/tools/tracing/explore_trace.py:29"}, "properties": {"repobilityId": "7858d95d9a6326a1", "scanner": "scanner-primary", "fingerprint": "b9d510c018a1ecaa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0f0d1c81954186f8", "level": "warning", "message": {"text": "Likely N+1 query: `for trace in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/analyze_errors.py:113"}, "properties": {"repobilityId": "b36fde96f6923593", "scanner": "scanner-primary", "fingerprint": "0f0d1c81954186f8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/tracing/analyze_errors.py"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-c6fd4201eea03660", "level": "warning", "message": {"text": "Likely N+1 query: `for score in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_trace_scores.py:150"}, "properties": {"repobilityId": "882d0a218cb5726b", "scanner": "scanner-primary", "fingerprint": "c6fd4201eea03660", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/tracing/list_trace_scores.py"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-2d05562d1864ce2c", "level": "warning", "message": {"text": "Likely N+1 query: `for s in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/tracing/list_sessions.py:65"}, "properties": {"repobilityId": "8002073c937a33a5", "scanner": "scanner-primary", "fingerprint": "2d05562d1864ce2c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/tracing/list_sessions.py"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-117f5ec41ca1b57f", "level": "warning", "message": {"text": "Likely N+1 query: `for exp in \u2026` triggers a query per row \u2014 futureagi/ai_tools/tools/experiments/list_experiments.py:58"}, "properties": {"repobilityId": "0448755ffa28575d", "scanner": "scanner-primary", "fingerprint": "117f5ec41ca1b57f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ai_tools/tools/experiments/list_experiments.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-a2d1df5cfe62deab", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/run_tests.py:31"}, "properties": {"repobilityId": "d888feef3b70f46c", "scanner": "scanner-primary", "fingerprint": "a2d1df5cfe62deab", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/run_tests.py"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-e19c7b700f08f084", "level": "note", "message": {"text": "Legacy-named symbol `dataset_v2` in futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py:135"}, "properties": {"repobilityId": "121265d40c8329c4", "scanner": "scanner-primary", "fingerprint": "e19c7b700f08f084", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-df766f05e7a7fa96", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py:47"}, "properties": {"repobilityId": "3373cab1beb37201", "scanner": "scanner-primary", "fingerprint": "df766f05e7a7fa96", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/llm_services/fi_api_service.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-95af07da5e1abd9c", "level": "note", "message": {"text": "Legacy-named symbol `_litellm_response_old` in futureagi/agentic_eval/core_evals/run_prompt/litellm_response.py:1883"}, "properties": {"repobilityId": "18fdb816110ebd6e", "scanner": "scanner-primary", "fingerprint": "95af07da5e1abd9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8f52cd1a9fb0d9b8", "level": "note", "message": {"text": "Legacy-named symbol `scribe_v1` in futureagi/agentic_eval/core_evals/run_prompt/available_models.py:349"}, "properties": {"repobilityId": "27699be811f00ec8", "scanner": "scanner-primary", "fingerprint": "8f52cd1a9fb0d9b8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a793aa51deece5c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/cartesia_response.py:239"}, "properties": {"repobilityId": "8a2a1d3ff95bc91d", "scanner": "scanner-primary", "fingerprint": "7a793aa51deece5c", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/cartesia_response.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-9cb954195173eaea", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/hume_response.py:100"}, "properties": {"repobilityId": "818007e1507fa25c", "scanner": "scanner-primary", "fingerprint": "9cb954195173eaea", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/hume_response.py"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-31a1a44731b8e3dc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/neuphonic_response.py:166"}, "properties": {"repobilityId": "88bf3d1ada53cc7a", "scanner": "scanner-primary", "fingerprint": "31a1a44731b8e3dc", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/neuphonic_response.py"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-2ae8bcddd3b043b0", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/lmnt_response.py:179"}, "properties": {"repobilityId": "124a0ae931898055", "scanner": "scanner-primary", "fingerprint": "2ae8bcddd3b043b0", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/lmnt_response.py"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-14fc7dd1f4de6ee8", "level": "note", "message": {"text": "Legacy-named symbol `scribe_v1` in futureagi/agentic_eval/core_evals/run_prompt/other_services/elevenlabs_response.py:251"}, "properties": {"repobilityId": "b4e88d3e481fdf6c", "scanner": "scanner-primary", "fingerprint": "14fc7dd1f4de6ee8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2feac9183ae769ef", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/inworld_response.py:84"}, "properties": {"repobilityId": "9da12e4c08cc9c72", "scanner": "scanner-primary", "fingerprint": "2feac9183ae769ef", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/inworld_response.py"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-9945e70ef3d98ac4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/rime_response.py:135"}, "properties": {"repobilityId": "7165d5054574b737", "scanner": "scanner-primary", "fingerprint": "9945e70ef3d98ac4", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/rime_response.py"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-763b65b354141887", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/agentic_eval/core_evals/run_prompt/other_services/deepgram_response.py:91"}, "properties": {"repobilityId": "33b65b7cd13f3eb1", "scanner": "scanner-primary", "fingerprint": "763b65b354141887", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/agentic_eval/core_evals/run_prompt/other_services/deepgram_response.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-2c412f5749b6dfe1", "level": "note", "message": {"text": "Stub function `to_config` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/base_evaluator.py:68"}, "properties": {"repobilityId": "d0989cab2cca219d", "scanner": "scanner-primary", "fingerprint": "2c412f5749b6dfe1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-3071a64420a925e5", "level": "note", "message": {"text": "Stub function `handle_data` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/functions.py:3335"}, "properties": {"repobilityId": "4d70b02041678a0d", "scanner": "scanner-primary", "fingerprint": "3071a64420a925e5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-ecf6ca377f74fd35", "level": "note", "message": {"text": "Stub function `_model` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/function/function_evaluator.py:22"}, "properties": {"repobilityId": "7d9d4ef83483b71e", "scanner": "scanner-primary", "fingerprint": "ecf6ca377f74fd35", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-d1b51febe4555873", "level": "note", "message": {"text": "Stub function `compare` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/grounded/similarity.py:8"}, "properties": {"repobilityId": "2fffc3a7b6df3654", "scanner": "scanner-primary", "fingerprint": "d1b51febe4555873", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-fb9b446570e04ab7", "level": "note", "message": {"text": "Stub function `_model` (body is just `pass`/`return`) \u2014 futureagi/agentic_eval/core_evals/fi_evals/grounded/grounded_evaluator.py:29"}, "properties": {"repobilityId": "baedbdcb04ce5fa0", "scanner": "scanner-primary", "fingerprint": "fb9b446570e04ab7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-0ec777c536b9c71a", "level": "note", "message": {"text": "Legacy-named symbol `qualitative_eval_parameter_prompt_v2` in futureagi/agentic_eval/core/utils/functions.py:31"}, "properties": {"repobilityId": "c44e31f94ef0404f", "scanner": "scanner-primary", "fingerprint": "0ec777c536b9c71a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b590cb419ce4559f", "level": "none", "message": {"text": "Commented-code block (11 lines) in futureagi/tracer/urls.py:96"}, "properties": {"repobilityId": "c7f9814295d1072e", "scanner": "scanner-primary", "fingerprint": "b590cb419ce4559f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/urls.py"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-1c220b87d4e830b5", "level": "none", "message": {"text": "Commented-code block (7 lines) in futureagi/tracer/utils/graphs.py:421"}, "properties": {"repobilityId": "0c8ad1a22dc94dad", "scanner": "scanner-primary", "fingerprint": "1c220b87d4e830b5", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/utils/graphs.py"}, "region": {"startLine": 421}}}]}, {"ruleId": "scanner-4f6e67b7187a86f3", "level": "note", "message": {"text": "Legacy-named symbol `config_copy` in futureagi/tracer/utils/graphs_optimized.py:340"}, "properties": {"repobilityId": "85b225ab6656ce3e", "scanner": "scanner-primary", "fingerprint": "4f6e67b7187a86f3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5047446f6b9cd8ce", "level": "none", "message": {"text": "Commented-code block (7 lines) in futureagi/tracer/utils/replay_session.py:550"}, "properties": {"repobilityId": "f7da500e4433d137", "scanner": "scanner-primary", "fingerprint": "5047446f6b9cd8ce", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/utils/replay_session.py"}, "region": {"startLine": 550}}}]}, {"ruleId": "scanner-7bd4257113c57586", "level": "note", "message": {"text": "Legacy-named symbol `_bulk_create_with_copy` in futureagi/tracer/utils/trace_ingestion.py:211"}, "properties": {"repobilityId": "f5c773070d3c2358", "scanner": "scanner-primary", "fingerprint": "7bd4257113c57586", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bc485ba67893b478", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_backfill.py:110"}, "properties": {"repobilityId": "613b476b9c68bc24", "scanner": "scanner-primary", "fingerprint": "bc485ba67893b478", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/management/commands/ch25_backfill.py"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-e11aada264820e52", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_doctor.py:80"}, "properties": {"repobilityId": "f0745b0adc2c9869", "scanner": "scanner-primary", "fingerprint": "e11aada264820e52", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/management/commands/ch25_doctor.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-0a377c303e1b218e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_remove_pg.py:72"}, "properties": {"repobilityId": "5a10cc4df94e84d9", "scanner": "scanner-primary", "fingerprint": "0a377c303e1b218e", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/management/commands/ch25_remove_pg.py"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-4205fad77d8485ad", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/management/commands/ch25_validate.py:91"}, "properties": {"repobilityId": "9fac39aad5621675", "scanner": "scanner-primary", "fingerprint": "4205fad77d8485ad", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/management/commands/ch25_validate.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-f5b0539b12f5a66b", "level": "note", "message": {"text": "Legacy-named symbol `physical_latest_users_v1` in futureagi/tracer/services/users_list_manager.py:84"}, "properties": {"repobilityId": "8bb9a894daf331b1", "scanner": "scanner-primary", "fingerprint": "f5b0539b12f5a66b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-925c732514bb20c4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/tracer/services/observability_providers.py:195"}, "properties": {"repobilityId": "10554df5132d5920", "scanner": "scanner-primary", "fingerprint": "925c732514bb20c4", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/services/observability_providers.py"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-52992664012b663c", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/graph_dispatch.py:161"}, "properties": {"repobilityId": "6f9462d15030ce18", "scanner": "scanner-primary", "fingerprint": "52992664012b663c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a59d034dfcf0012a", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/exact_graph_reads.py:82"}, "properties": {"repobilityId": "3dde7041136d8803", "scanner": "scanner-primary", "fingerprint": "a59d034dfcf0012a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1cd1308965312dcd", "level": "note", "message": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/schema.py:87"}, "properties": {"repobilityId": "74a2ec2116f19e30", "scanner": "scanner-primary", "fingerprint": "1cd1308965312dcd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f737dfe9a73d4771", "level": "note", "message": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tracer/services/clickhouse/eval_logger_table.py:5"}, "properties": {"repobilityId": "ed1c8b2beeb821c8", "scanner": "scanner-primary", "fingerprint": "f737dfe9a73d4771", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bd4b9242dbcccc51", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/filter_value_reads.py:38"}, "properties": {"repobilityId": "656d7ca2963570af", "scanner": "scanner-primary", "fingerprint": "bd4b9242dbcccc51", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bc7d63f0fd5f7640", "level": "note", "message": {"text": "Legacy-named symbol `ch25_no_v2_class_falling_back_to_v1` in futureagi/tracer/services/clickhouse/v2/shadowed_builder.py:105"}, "properties": {"repobilityId": "04f0b67762fcbf32", "scanner": "scanner-primary", "fingerprint": "bc7d63f0fd5f7640", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2e632ff7ba57cee2", "level": "note", "message": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/span_reader.py:1978"}, "properties": {"repobilityId": "c7ff45cb353e7f22", "scanner": "scanner-primary", "fingerprint": "2e632ff7ba57cee2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d1284ce0e567678a", "level": "note", "message": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/apply_schema.py:27"}, "properties": {"repobilityId": "b36c4c66f2550e0d", "scanner": "scanner-primary", "fingerprint": "d1284ce0e567678a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-47f23c023b344262", "level": "note", "message": {"text": "Legacy-named symbol `rows_v1` in futureagi/tracer/services/clickhouse/v2/shadow.py:58"}, "properties": {"repobilityId": "b97d18c363876cb3", "scanner": "scanner-primary", "fingerprint": "47f23c023b344262", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a940ffa66a9e34e7", "level": "note", "message": {"text": "Legacy-named symbol `use_v2` in futureagi/tracer/services/clickhouse/v2/dispatch.py:148"}, "properties": {"repobilityId": "550a38c8ba1e4995", "scanner": "scanner-primary", "fingerprint": "a940ffa66a9e34e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c04673499735c058", "level": "note", "message": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/v2/adapter.py:61"}, "properties": {"repobilityId": "d73afea14bfca2c1", "scanner": "scanner-primary", "fingerprint": "c04673499735c058", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-443321d5f10f42bc", "level": "note", "message": {"text": "Legacy-named symbol `ch25_shadow_requested_but_no_v2_class_falling_back_to_v1` in futureagi/tracer/services/clickhouse/v2/run_query.py:115"}, "properties": {"repobilityId": "b9b4e0e853b85cdb", "scanner": "scanner-primary", "fingerprint": "443321d5f10f42bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fb57dd35dbbe7e6d", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/v2/query_builders/filters.py:270"}, "properties": {"repobilityId": "3d6958c82f3edfcd", "scanner": "scanner-primary", "fingerprint": "fb57dd35dbbe7e6d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5968b92605d04a2e", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/v2/query_builders/_rewrite.py:23"}, "properties": {"repobilityId": "428ee01c27356506", "scanner": "scanner-primary", "fingerprint": "5968b92605d04a2e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-763d2367f7221daa", "level": "note", "message": {"text": "Legacy-named symbol `expected_v1` in futureagi/tracer/services/clickhouse/v2/property_catalog/span_source.py:292"}, "properties": {"repobilityId": "ad2ebacb76cb95bf", "scanner": "scanner-primary", "fingerprint": "763d2367f7221daa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d39725dbae3de973", "level": "note", "message": {"text": "Legacy-named symbol `is_v2` in futureagi/tracer/services/clickhouse/query_builders/voice_call_list.py:1176"}, "properties": {"repobilityId": "6e8b962c4223202e", "scanner": "scanner-primary", "fingerprint": "d39725dbae3de973", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7588072dd170e0b9", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/exact_graph_predicates.py:638"}, "properties": {"repobilityId": "b90557c41fc61479", "scanner": "scanner-primary", "fingerprint": "7588072dd170e0b9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f78983ead6f63cfb", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/user_list.py:434"}, "properties": {"repobilityId": "70432fd1f044e2fe", "scanner": "scanner-primary", "fingerprint": "f78983ead6f63cfb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9916bdfddb312e01", "level": "note", "message": {"text": "Legacy-named symbol `standalone_v2` in futureagi/tracer/services/clickhouse/query_builders/dashboard.py:253"}, "properties": {"repobilityId": "9e5a23cad32d60e8", "scanner": "scanner-primary", "fingerprint": "9916bdfddb312e01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c2292d5f06518472", "level": "note", "message": {"text": "Stub function `recommended_filter_cursor_seed_batch_size` (body is just `pass`/`return`) \u2014 futureagi/tracer/services/clickhouse/query_builders/session_list.py:843"}, "properties": {"repobilityId": "6ae8f1b94b6239f4", "scanner": "scanner-primary", "fingerprint": "c2292d5f06518472", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-83c0b12824fa65dc", "level": "note", "message": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in futureagi/tracer/services/clickhouse/query_builders/filters.py:2491"}, "properties": {"repobilityId": "658ea6d1e68b22d1", "scanner": "scanner-primary", "fingerprint": "83c0b12824fa65dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3871a5a18561f555", "level": "note", "message": {"text": "Legacy-named symbol `002_spans_v2` in futureagi/tracer/services/clickhouse/query_builders/base.py:145"}, "properties": {"repobilityId": "119fcab1a99e857b", "scanner": "scanner-primary", "fingerprint": "3871a5a18561f555", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-517dae84fb6fc484", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/time_series.py:853"}, "properties": {"repobilityId": "920533962c30dd04", "scanner": "scanner-primary", "fingerprint": "517dae84fb6fc484", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-55d81de28c878a00", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in futureagi/tracer/services/clickhouse/query_builders/latest_filter_predicates.py:1339"}, "properties": {"repobilityId": "78f3efcec2e3ebd4", "scanner": "scanner-primary", "fingerprint": "55d81de28c878a00", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7aabf4ab6c3003c2", "level": "note", "message": {"text": "Legacy-named symbol `input_backup` in futureagi/tracer/migrations/0038_observationspan_input_backup_and_more.py:15"}, "properties": {"repobilityId": "5da2e9cc7dd15ae3", "scanner": "scanner-primary", "fingerprint": "7aabf4ab6c3003c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1d0e45321573814b", "level": "note", "message": {"text": "Legacy-named symbol `input_backup` in futureagi/tracer/migrations/0039_remove_observationspan_input_backup_and_more.py:15"}, "properties": {"repobilityId": "e5915e7ab8803fa1", "scanner": "scanner-primary", "fingerprint": "1d0e45321573814b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-571bc4a827a7c107", "level": "warning", "message": {"text": "Likely N+1 query: `for issue in \u2026` triggers a query per row \u2014 futureagi/tracer/queries/scan_clustering.py:131"}, "properties": {"repobilityId": "006160cf5117af2b", "scanner": "scanner-primary", "fingerprint": "571bc4a827a7c107", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/queries/scan_clustering.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-7187b598eff37e10", "level": "note", "message": {"text": "Legacy-named symbol `after_old` in futureagi/tracer/selectors/eval_tasks/continuous_candidates.py:984"}, "properties": {"repobilityId": "d84d8955257169e3", "scanner": "scanner-primary", "fingerprint": "7187b598eff37e10", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1feffd6072d0908c", "level": "note", "message": {"text": "Legacy-named symbol `project_batches_v1` in futureagi/tracer/views/dashboard.py:486"}, "properties": {"repobilityId": "54dadd783e524cc3", "scanner": "scanner-primary", "fingerprint": "1feffd6072d0908c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1b7de4c5fbd3122e", "level": "warning", "message": {"text": "Likely N+1 query: `for a in \u2026` triggers a query per row \u2014 futureagi/tracer/views/dashboard.py:6583"}, "properties": {"repobilityId": "591402473d3bbba6", "scanner": "scanner-primary", "fingerprint": "1b7de4c5fbd3122e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/dashboard.py"}, "region": {"startLine": 6583}}}]}, {"ruleId": "scanner-7e22037a43d40526", "level": "warning", "message": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/observation_span.py:4397"}, "properties": {"repobilityId": "5a13a7c7af2401a7", "scanner": "scanner-primary", "fingerprint": "7e22037a43d40526", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/observation_span.py"}, "region": {"startLine": 4397}}}]}, {"ruleId": "scanner-c9298f4aaf02c7be", "level": "warning", "message": {"text": "Likely N+1 query: `for log in \u2026` triggers a query per row \u2014 futureagi/tracer/views/eval_task.py:2548"}, "properties": {"repobilityId": "9ddb6f4b8dd01a16", "scanner": "scanner-primary", "fingerprint": "c9298f4aaf02c7be", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/eval_task.py"}, "region": {"startLine": 2548}}}]}, {"ruleId": "scanner-9b55453dc9e08a07", "level": "warning", "message": {"text": "Likely N+1 query: `for note in \u2026` triggers a query per row \u2014 futureagi/tracer/views/annotation.py:457"}, "properties": {"repobilityId": "d0eb34b488441189", "scanner": "scanner-primary", "fingerprint": "9b55453dc9e08a07", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/annotation.py"}, "region": {"startLine": 457}}}]}, {"ruleId": "scanner-11ca7d5ddbe6f05c", "level": "note", "message": {"text": "Legacy-named symbol `fetch_graph_v2` in futureagi/tracer/views/charts.py:233"}, "properties": {"repobilityId": "ec750b9e36bd1fda", "scanner": "scanner-primary", "fingerprint": "11ca7d5ddbe6f05c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-020c4af82e4bb908", "level": "none", "message": {"text": "Commented-code block (7 lines) in futureagi/tracer/views/project_version.py:978"}, "properties": {"repobilityId": "3d1a63591297b366", "scanner": "scanner-primary", "fingerprint": "020c4af82e4bb908", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/project_version.py"}, "region": {"startLine": 978}}}]}, {"ruleId": "scanner-95966ffdf66e29ee", "level": "warning", "message": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/project_version.py:271"}, "properties": {"repobilityId": "28d133c0e5717049", "scanner": "scanner-primary", "fingerprint": "95966ffdf66e29ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/project_version.py"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-2fff69b8513f6038", "level": "warning", "message": {"text": "Likely N+1 query: `for config in \u2026` triggers a query per row \u2014 futureagi/tracer/views/trace.py:3345"}, "properties": {"repobilityId": "ce64d2e0d82296b8", "scanner": "scanner-primary", "fingerprint": "2fff69b8513f6038", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/trace.py"}, "region": {"startLine": 3345}}}]}, {"ruleId": "scanner-5d74c8c1892bfddc", "level": "warning", "message": {"text": "Likely N+1 query: `for score in \u2026` triggers a query per row \u2014 futureagi/tracer/views/trace_session.py:3634"}, "properties": {"repobilityId": "0fd7f9f068895b79", "scanner": "scanner-primary", "fingerprint": "5d74c8c1892bfddc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tracer/views/trace_session.py"}, "region": {"startLine": 3634}}}]}, {"ruleId": "scanner-f2af5cb61479bd1c", "level": "note", "message": {"text": "Legacy-named symbol `StandaloneEvalView_v2` in futureagi/sdk/urls.py:14"}, "properties": {"repobilityId": "a3a6f68a7d24e83d", "scanner": "scanner-primary", "fingerprint": "f2af5cb61479bd1c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c824f370fe2fb448", "level": "note", "message": {"text": "Legacy-named symbol `standalone_v2` in futureagi/sdk/utils/evaluations.py:40"}, "properties": {"repobilityId": "81e82353d5063ecd", "scanner": "scanner-primary", "fingerprint": "c824f370fe2fb448", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-75ed157ebb446a5a", "level": "note", "message": {"text": "Legacy-named symbol `StandaloneEvalView_v2` in futureagi/sdk/views/evaluations.py:232"}, "properties": {"repobilityId": "adaefd47031d3f3e", "scanner": "scanner-primary", "fingerprint": "75ed157ebb446a5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-48a1ba46a8522fe0", "level": "none", "message": {"text": "Commented-code block (19 lines) in futureagi/ee/usage/apps.py:36"}, "properties": {"repobilityId": "19c2fed9d9b22139", "scanner": "scanner-primary", "fingerprint": "48a1ba46a8522fe0", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/usage/apps.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-a668cacd59ac23de", "level": "none", "message": {"text": "Commented-code block (7 lines) in futureagi/ee/usage/models/__init__.py:1"}, "properties": {"repobilityId": "22ae34010d6a865a", "scanner": "scanner-primary", "fingerprint": "a668cacd59ac23de", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/usage/models/__init__.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bef25aef7e161f08", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/ee/usage/utils/usage_entries.py:1982"}, "properties": {"repobilityId": "1bc3f2f33a996252", "scanner": "scanner-primary", "fingerprint": "bef25aef7e161f08", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/usage/utils/usage_entries.py"}, "region": {"startLine": 1982}}}]}, {"ruleId": "scanner-4f2d89650fedf2ae", "level": "note", "message": {"text": "Stub function `check_if_row_limit_reached` (body is just `pass`/`return`) \u2014 futureagi/ee/usage/utils/usage_entries.py:2194"}, "properties": {"repobilityId": "ec8884463a520882", "scanner": "scanner-primary", "fingerprint": "4f2d89650fedf2ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-1ba6df37d3a9bed8", "level": "note", "message": {"text": "Legacy-named symbol `tag_for_reason_prompt_v2` in futureagi/ee/agenthub/tags_generation_agent/tags_v2.py:8"}, "properties": {"repobilityId": "6d467570cd943ac3", "scanner": "scanner-primary", "fingerprint": "1ba6df37d3a9bed8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e4330921ff483fa0", "level": "note", "message": {"text": "Legacy-named symbol `tag_for_reason_prompt_v2` in futureagi/ee/agenthub/tags_generation_agent/prompt.py:10"}, "properties": {"repobilityId": "05951fcd4092b2e1", "scanner": "scanner-primary", "fingerprint": "e4330921ff483fa0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bfa118a3e9ffecee", "level": "note", "message": {"text": "Legacy-named symbol `data_copy` in futureagi/ee/agenthub/fix_your_agent/simulation_adapter.py:1833"}, "properties": {"repobilityId": "417832bcf2db360f", "scanner": "scanner-primary", "fingerprint": "bfa118a3e9ffecee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-db840e5948183046", "level": "note", "message": {"text": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/traceerroragent/judge.py:19"}, "properties": {"repobilityId": "0a99f537f15a16bc", "scanner": "scanner-primary", "fingerprint": "db840e5948183046", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5e454f7561f26e84", "level": "note", "message": {"text": "Legacy-named symbol `_summarize_logic_v2` in futureagi/ee/agenthub/traceerroragent/traceerror.py:329"}, "properties": {"repobilityId": "27e53b71ff818f29", "scanner": "scanner-primary", "fingerprint": "5e454f7561f26e84", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ff0bdd60e4fa7039", "level": "note", "message": {"text": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/traceerroragent/chauffeur.py:16"}, "properties": {"repobilityId": "1da53beea5d4c924", "scanner": "scanner-primary", "fingerprint": "ff0bdd60e4fa7039", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a1ec8bf887ef2805", "level": "note", "message": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/explanation_agent/exp_agent.py:19"}, "properties": {"repobilityId": "203d9ba294915baf", "scanner": "scanner-primary", "fingerprint": "a1ec8bf887ef2805", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-603c2d115cc6f1d8", "level": "note", "message": {"text": "Legacy-named symbol `agent_copy` in futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py:662"}, "properties": {"repobilityId": "0066c6a7b7af992d", "scanner": "scanner-primary", "fingerprint": "603c2d115cc6f1d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8424f156c973f5ee", "level": "none", "message": {"text": "Commented-code block (10 lines) in futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py:948"}, "properties": {"repobilityId": "2318ac4d62e60b08", "scanner": "scanner-primary", "fingerprint": "8424f156c973f5ee", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/agenthub/scenario_graph/enhanced_scenarios_agent.py"}, "region": {"startLine": 948}}}]}, {"ruleId": "scanner-f0a22b2ae31918ac", "level": "note", "message": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/workflow_agent/auto_events_generator.py:16"}, "properties": {"repobilityId": "49bc71086155c873", "scanner": "scanner-primary", "fingerprint": "f0a22b2ae31918ac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c947a0e67db3459f", "level": "note", "message": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/workflow_agent/agent_task.py:4"}, "properties": {"repobilityId": "3785c017f10a2618", "scanner": "scanner-primary", "fingerprint": "c947a0e67db3459f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f0fdff33b669e274", "level": "note", "message": {"text": "Legacy-named symbol `rag_rank_evaluation_agent_v2` in futureagi/ee/agenthub/text_eval_agent/eval_text_llm.py:8"}, "properties": {"repobilityId": "338dc128a9acbf47", "scanner": "scanner-primary", "fingerprint": "f0fdff33b669e274", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2aaa0b76398bc462", "level": "note", "message": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py:6"}, "properties": {"repobilityId": "51c0683c3c50475c", "scanner": "scanner-primary", "fingerprint": "2aaa0b76398bc462", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-811d250c053a2e31", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py:753"}, "properties": {"repobilityId": "35e22371a00fd01b", "scanner": "scanner-primary", "fingerprint": "811d250c053a2e31", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent.py"}, "region": {"startLine": 753}}}]}, {"ruleId": "scanner-2ca9a11e1484d256", "level": "note", "message": {"text": "Legacy-named symbol `plan_details_copy` in futureagi/ee/agenthub/synthetic_data_agent/synthetic_data_agent_old.py:1479"}, "properties": {"repobilityId": "4681f5f749df4bf1", "scanner": "scanner-primary", "fingerprint": "2ca9a11e1484d256", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d499ca71ba85e25c", "level": "note", "message": {"text": "Legacy-named symbol `prompts_v2` in futureagi/ee/agenthub/rag_rank_eval_agent/rag_rank_evaluation_agent_v2.py:15"}, "properties": {"repobilityId": "79fa5b9d2a7e01d5", "scanner": "scanner-primary", "fingerprint": "d499ca71ba85e25c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-79cabcff4c626783", "level": "note", "message": {"text": "Legacy-named symbol `rag_analyze_subqueries_gain_prompt_old` in futureagi/ee/agenthub/rag_rank_eval_agent/prompts_v2.py:79"}, "properties": {"repobilityId": "82b489bd4f89323c", "scanner": "scanner-primary", "fingerprint": "79cabcff4c626783", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9c2f8e2b93c0d714", "level": "note", "message": {"text": "Legacy-named symbol `_improve_prompt_old` in futureagi/ee/agenthub/prompt_generate_agent/prompt_generate.py:564"}, "properties": {"repobilityId": "5f993e478578f71b", "scanner": "scanner-primary", "fingerprint": "9c2f8e2b93c0d714", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1fc70d82b725b933", "level": "warning", "message": {"text": "Likely N+1 query: `for eval_metric in \u2026` triggers a query per row \u2014 futureagi/ee/agenthub/prompt_optimizer_agent/agent_task_v2.py:291"}, "properties": {"repobilityId": "d8bfb1ecc7a4d2da", "scanner": "scanner-primary", "fingerprint": "1fc70d82b725b933", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/agenthub/prompt_optimizer_agent/agent_task_v2.py"}, "region": {"startLine": 291}}}]}, {"ruleId": "scanner-44b65dbbfef724dd", "level": "note", "message": {"text": "Stub function `_log_metrics` (body is just `pass`/`return`) \u2014 futureagi/ee/agenthub/prompt_optimizer_agent/agent_task_v2.py:626"}, "properties": {"repobilityId": "8a276ab920aefae8", "scanner": "scanner-primary", "fingerprint": "44b65dbbfef724dd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-ed8667126f9b0137", "level": "note", "message": {"text": "Legacy-named symbol `eleven_multilingual_v2` in futureagi/ee/voice/services/vapi_service.py:335"}, "properties": {"repobilityId": "edb5a8d76b30f507", "scanner": "scanner-primary", "fingerprint": "ed8667126f9b0137", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d682a69bd4808519", "level": "warning", "message": {"text": "Likely N+1 query: `for call_exec in \u2026` triggers a query per row \u2014 futureagi/ee/voice/services/call_limit_service.py:195"}, "properties": {"repobilityId": "29dcc9f743470980", "scanner": "scanner-primary", "fingerprint": "d682a69bd4808519", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/voice/services/call_limit_service.py"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-c93fd85fe31da675", "level": "note", "message": {"text": "Legacy-named symbol `summary_judgement_prompt_ragrank_v2` in futureagi/ee/prompts/eval_prompts.py:55"}, "properties": {"repobilityId": "28b254dcbb5e7c7c", "scanner": "scanner-primary", "fingerprint": "c93fd85fe31da675", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5f1f4f5fc330f414", "level": "note", "message": {"text": "Legacy-named symbol `rag_rank_evaluation_agent_v2` in futureagi/ee/evals/futureagi/eval_ranking/evaluator.py:9"}, "properties": {"repobilityId": "8b4d7dfdb5fb9365", "scanner": "scanner-primary", "fingerprint": "5f1f4f5fc330f414", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c892449edd9b2901", "level": "note", "message": {"text": "Stub function `_no_op` (body is just `pass`/`return`) \u2014 futureagi/ee/evals/localizer/error_localizer.py:743"}, "properties": {"repobilityId": "d689d07fe42e605d", "scanner": "scanner-primary", "fingerprint": "c892449edd9b2901", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-c1833c1247c4bb36", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/ee/evals/llm/agent_evaluator/context/budget.py:29"}, "properties": {"repobilityId": "7b4489f6e7d28ae5", "scanner": "scanner-primary", "fingerprint": "c1833c1247c4bb36", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/evals/llm/agent_evaluator/context/budget.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-995cb7fb9ed356c4", "level": "note", "message": {"text": "Legacy-named symbol `compacted_old` in futureagi/ee/falcon_ai/context_manager.py:109"}, "properties": {"repobilityId": "17b4000e300567d2", "scanner": "scanner-primary", "fingerprint": "995cb7fb9ed356c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bf3aeb1d13171149", "level": "warning", "message": {"text": "Likely N+1 query: `for f in \u2026` triggers a query per row \u2014 futureagi/ee/falcon_ai/consumers.py:774"}, "properties": {"repobilityId": "9e972add018b6478", "scanner": "scanner-primary", "fingerprint": "bf3aeb1d13171149", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/falcon_ai/consumers.py"}, "region": {"startLine": 774}}}]}, {"ruleId": "scanner-d4990a81c50a3631", "level": "note", "message": {"text": "Stub function `reverse_noop` (body is just `pass`/`return`) \u2014 futureagi/ee/falcon_ai/migrations/0007_global_builtin_skills.py:31"}, "properties": {"repobilityId": "ee52920fe15dd9fc", "scanner": "scanner-primary", "fingerprint": "d4990a81c50a3631", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-7e092daf1df37e4c", "level": "note", "message": {"text": "Legacy-named symbol `embeddings_v2` in futureagi/ee/experiments/src/agent/tags.py:7"}, "properties": {"repobilityId": "947cf01b881d062f", "scanner": "scanner-primary", "fingerprint": "7e092daf1df37e4c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e0991c9fb76867cc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 futureagi/saml2_auth/views.py:1039"}, "properties": {"repobilityId": "9a5c3fd8259def68", "scanner": "scanner-primary", "fingerprint": "e0991c9fb76867cc", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/saml2_auth/views.py"}, "region": {"startLine": 1039}}}]}, {"ruleId": "scanner-a8cfd5b807c94d6f", "level": "none", "message": {"text": "Commented-code block (6 lines) in futureagi/saml2_auth/admin.py:23"}, "properties": {"repobilityId": "cabc1ec650af26cb", "scanner": "scanner-primary", "fingerprint": "a8cfd5b807c94d6f", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/saml2_auth/admin.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a59c050a2e045713", "level": "note", "message": {"text": "Stub function `ready` (body is just `pass`/`return`) \u2014 futureagi/saml2_auth/apps.py:8"}, "properties": {"repobilityId": "581618291f244dad", "scanner": "scanner-primary", "fingerprint": "a59c050a2e045713", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-bb3073a965f7b17b", "level": "none", "message": {"text": "Commented-code block (5 lines) in futureagi/saml2_auth/models.py:57"}, "properties": {"repobilityId": "beb4e6dce79a0027", "scanner": "scanner-primary", "fingerprint": "bb3073a965f7b17b", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/saml2_auth/models.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-e8163b0718badc3e", "level": "none", "message": {"text": "Commented-code block (7 lines) in futureagi/saml2_auth/forms.py:41"}, "properties": {"repobilityId": "b020b756f1537710", "scanner": "scanner-primary", "fingerprint": "e8163b0718badc3e", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/saml2_auth/forms.py"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-bcfd81c5557c8c09", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/generate-agentcc-gateway-contracts.py:256"}, "properties": {"repobilityId": "c54aba74d5cb3e6f", "scanner": "scanner-primary", "fingerprint": "bcfd81c5557c8c09", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate-agentcc-gateway-contracts.py"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-3572a7aa39aa3587", "level": "note", "message": {"text": "Legacy-named symbol `tracer_eval_logger_v2` in scripts/qa/replay_observe_queries_readonly.py:117"}, "properties": {"repobilityId": "485b0a0dc11bfeda", "scanner": "scanner-primary", "fingerprint": "3572a7aa39aa3587", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1b00c724cd8a1e38", "level": "note", "message": {"text": "Legacy-named symbol `rewrite_v1_sql_to_v2` in scripts/qa/probe_long_text_index_contract_readonly.py:348"}, "properties": {"repobilityId": "4985f4152d7be2f6", "scanner": "scanner-primary", "fingerprint": "1b00c724cd8a1e38", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-80b5c0823585d098", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 deploy/dev/property-catalog-docker/provision_0816d.py:145"}, "properties": {"repobilityId": "994fa1a720b83fe0", "scanner": "scanner-primary", "fingerprint": "80b5c0823585d098", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/dev/property-catalog-docker/provision_0816d.py"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-96416a7de68ccb98", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 deploy/dev/property-catalog-docker/provision_existing_steady.py:47"}, "properties": {"repobilityId": "a169f1d2cf5bb286", "scanner": "scanner-primary", "fingerprint": "96416a7de68ccb98", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/dev/property-catalog-docker/provision_existing_steady.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-42ac486b97224cb4", "level": "note", "message": {"text": "Legacy-named symbol `002_spans_v2` in e2e/scripts/e2e-coverage.test.mjs:88"}, "properties": {"repobilityId": "acc5cd7c3a6b490f", "scanner": "scanner-primary", "fingerprint": "42ac486b97224cb4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fdb6ca5f374fbcc0", "level": "note", "message": {"text": "494 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5742bc9ae4110ea2", "scanner": "scanner-primary", "fingerprint": "fdb6ca5f374fbcc0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0109e6dd39519bac", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "be5ede39a7a763e0", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-f4bba556d36c70bc", "level": "warning", "message": {"text": "Frontend route `/dashboard/observe/:observeId` has no Link/navigate to it \u2014 frontend/src/sections/projects/__tests__/ObservePage.test.jsx"}, "properties": {"repobilityId": "418f3d1d3e4adefe", "scanner": "scanner-primary", "fingerprint": "f4bba556d36c70bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-b0b32afbe43fef08", "level": "warning", "message": {"text": "Frontend route `/dataset/:dataset` has no Link/navigate to it \u2014 frontend/src/sections/develop-detail/Common/AddEvaluation/AddedEvaluationCard.stories.jsx"}, "properties": {"repobilityId": "f9d5be4b3a477786", "scanner": "scanner-primary", "fingerprint": "b0b32afbe43fef08", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-49973ad80c1a8516", "level": "warning", "message": {"text": "Frontend route `/dashboard/tasks/:taskId` has no Link/navigate to it \u2014 frontend/src/sections/tasks/__tests__/TaskDetailPage.test.jsx"}, "properties": {"repobilityId": "656548d3c7cb7f9d", "scanner": "scanner-primary", "fingerprint": "49973ad80c1a8516", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-9d9f9dacf4d75ef2", "level": "error", "message": {"text": "DRF view `AIFilterView` declares no `permission_classes` \u2014 futureagi/model_hub/views/ai_filter.py:1661"}, "properties": {"repobilityId": "7a004954d09905fb", "scanner": "scanner-primary", "fingerprint": "9d9f9dacf4d75ef2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.drf.no_permission_classes"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_hub/views/ai_filter.py"}, "region": {"startLine": 1661}}}]}, {"ruleId": "scanner-28896eb0b267dedc", "level": "error", "message": {"text": "DRF view `AsyncAPIView` declares no `permission_classes` \u2014 futureagi/simulate/views/livekit_api.py:149"}, "properties": {"repobilityId": "a5ab2da9e45f0e28", "scanner": "scanner-primary", "fingerprint": "28896eb0b267dedc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.drf.no_permission_classes"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-050f1bef1596d47a", "level": "warning", "message": {"text": "Django CBV `CallConfigView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:229"}, "properties": {"repobilityId": "4c1ed502b10fe707", "scanner": "scanner-primary", "fingerprint": "050f1bef1596d47a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-26120562f8ef1630", "level": "warning", "message": {"text": "Django CBV `TranscriptsView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:250"}, "properties": {"repobilityId": "d5850245a847334f", "scanner": "scanner-primary", "fingerprint": "26120562f8ef1630", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-1c158713f4338274", "level": "warning", "message": {"text": "Django CBV `PhoneResolutionView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:300"}, "properties": {"repobilityId": "3bc339d814ddcc9c", "scanner": "scanner-primary", "fingerprint": "1c158713f4338274", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-1ed2addcc375c6aa", "level": "warning", "message": {"text": "Django CBV `CallExecutionUpdateView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:321"}, "properties": {"repobilityId": "f4000518647d2f59", "scanner": "scanner-primary", "fingerprint": "1ed2addcc375c6aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-25bb047ad80278dd", "level": "warning", "message": {"text": "Django CBV `TemporalSignalView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:359"}, "properties": {"repobilityId": "9c1a0b71313af82f", "scanner": "scanner-primary", "fingerprint": "25bb047ad80278dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 359}}}]}, {"ruleId": "scanner-852a41153505753d", "level": "warning", "message": {"text": "Django CBV `LiveKitWebhookView` lacks `LoginRequiredMixin` \u2014 futureagi/simulate/views/livekit_api.py:652"}, "properties": {"repobilityId": "d7313b3ce8e00f12", "scanner": "scanner-primary", "fingerprint": "852a41153505753d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/simulate/views/livekit_api.py"}, "region": {"startLine": 652}}}]}, {"ruleId": "scanner-527478c759097300", "level": "warning", "message": {"text": "Django CBV `CustomTokenObtainPairView` lacks `LoginRequiredMixin` \u2014 futureagi/accounts/views/user.py:136"}, "properties": {"repobilityId": "5a0295c813ef60bb", "scanner": "scanner-primary", "fingerprint": "527478c759097300", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/accounts/views/user.py"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-1c6a624f05dd0b78", "level": "error", "message": {"text": "DRF view `HealthCheckView` declares no `permission_classes` \u2014 futureagi/tfc/views/health.py:17"}, "properties": {"repobilityId": "438793bfe7793450", "scanner": "scanner-primary", "fingerprint": "1c6a624f05dd0b78", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.drf.no_permission_classes"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/tfc/views/health.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-3a7020516712d27e", "level": "error", "message": {"text": "DRF view `MCPOAuthAuthorizeView` declares no `permission_classes` \u2014 futureagi/mcp_server/views/oauth.py:91"}, "properties": {"repobilityId": "2c78b3fdc3b19d3b", "scanner": "scanner-primary", "fingerprint": "3a7020516712d27e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.drf.no_permission_classes"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/mcp_server/views/oauth.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-e9c78bdd556400d6", "level": "error", "message": {"text": "FastAPI POST `infer` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:79"}, "properties": {"repobilityId": "cad1f17e481bb14e", "scanner": "scanner-primary", "fingerprint": "e9c78bdd556400d6", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/app/v1/endpoints.py"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-8821a53ad87b1be6", "level": "error", "message": {"text": "FastAPI POST `embed_text` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:190"}, "properties": {"repobilityId": "7c8d88006d1f00c6", "scanner": "scanner-primary", "fingerprint": "8821a53ad87b1be6", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/app/v1/endpoints.py"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-b8374daad7ca750d", "level": "error", "message": {"text": "FastAPI POST `embed_image` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:213"}, "properties": {"repobilityId": "c307df66215d1b55", "scanner": "scanner-primary", "fingerprint": "b8374daad7ca750d", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/app/v1/endpoints.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-7eb57cbfb544a453", "level": "error", "message": {"text": "FastAPI POST `embed_audio` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:236"}, "properties": {"repobilityId": "910ce23ce4ef3d6f", "scanner": "scanner-primary", "fingerprint": "7eb57cbfb544a453", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/app/v1/endpoints.py"}, "region": {"startLine": 236}}}]}, {"ruleId": "scanner-b3ea5aefee8e7b42", "level": "error", "message": {"text": "FastAPI POST `embed_image_text` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:259"}, "properties": {"repobilityId": "dfe941b90ee83ad5", "scanner": "scanner-primary", "fingerprint": "b3ea5aefee8e7b42", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/app/v1/endpoints.py"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-7d20fe3dc5f19432", "level": "error", "message": {"text": "FastAPI POST `embed_syn_data` without auth dependency \u2014 futureagi/model_serving/app/v1/endpoints.py:285"}, "properties": {"repobilityId": "7a8ab128f473ddc6", "scanner": "scanner-primary", "fingerprint": "7d20fe3dc5f19432", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/model_serving/app/v1/endpoints.py"}, "region": {"startLine": 285}}}]}, {"ruleId": "scanner-0e840efe4ef10ac7", "level": "warning", "message": {"text": "Django view `get_alias` may be unauthenticated \u2014 futureagi/saml2_auth/views.py:204"}, "properties": {"repobilityId": "37f82296d3f05b0b", "scanner": "scanner-primary", "fingerprint": "0e840efe4ef10ac7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/saml2_auth/views.py"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-2ec6b93123da3b85", "level": "error", "message": {"text": "DRF view `ACSView` declares no `permission_classes` \u2014 futureagi/saml2_auth/views.py:218"}, "properties": {"repobilityId": "0fd4b10f18cfc507", "scanner": "scanner-primary", "fingerprint": "2ec6b93123da3b85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.drf.no_permission_classes"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/saml2_auth/views.py"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-bf795351de8316d4", "level": "error", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-35jp-ww65-95wh"}, "properties": {"repobilityId": "9fe6b7df18538fa8", "scanner": "scanner-primary", "fingerprint": "bf795351de8316d4", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-35jp-ww65-95wh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e44952b5a90ac9d7", "level": "error", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-3g43-6gmg-66jw"}, "properties": {"repobilityId": "fcca311757e5e0eb", "scanner": "scanner-primary", "fingerprint": "e44952b5a90ac9d7", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g43-6gmg-66jw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14f33c733063f4c9", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-3p68-rc4w-qgx5"}, "properties": {"repobilityId": "97081d4a327d307d", "scanner": "scanner-primary", "fingerprint": "14f33c733063f4c9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3p68-rc4w-qgx5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2c5b6f5d81b94f3", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-3w6x-2g7m-8v23"}, "properties": {"repobilityId": "aa12462020fc2e3e", "scanner": "scanner-primary", "fingerprint": "c2c5b6f5d81b94f3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3w6x-2g7m-8v23"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf8b4d37df9d8c6b", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-42h9-826w-cgv3"}, "properties": {"repobilityId": "4f30b20d261304f1", "scanner": "scanner-primary", "fingerprint": "bf8b4d37df9d8c6b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-42h9-826w-cgv3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6453f1219a673e55", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-43fc-jf86-j433"}, "properties": {"repobilityId": "09477a0e2d78fcc9", "scanner": "scanner-primary", "fingerprint": "6453f1219a673e55", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-43fc-jf86-j433"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d74b0e86e43d8af", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-445q-vr5w-6q77"}, "properties": {"repobilityId": "9d45f7ff139b5b4a", "scanner": "scanner-primary", "fingerprint": "5d74b0e86e43d8af", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-445q-vr5w-6q77"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-402de9781b13084c", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-4hjh-wcwx-xvwj"}, "properties": {"repobilityId": "36b6ea2be5f2f2b5", "scanner": "scanner-primary", "fingerprint": "402de9781b13084c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4hjh-wcwx-xvwj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-82d72752c94fa68a", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-5c9x-8gcm-mpgx"}, "properties": {"repobilityId": "0697e0d53e280c01", "scanner": "scanner-primary", "fingerprint": "82d72752c94fa68a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5c9x-8gcm-mpgx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecd53d1bf869dfc0", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-62hf-57xw-28j9"}, "properties": {"repobilityId": "0999f2dcc0aab4aa", "scanner": "scanner-primary", "fingerprint": "ecd53d1bf869dfc0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-62hf-57xw-28j9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe6f7a845b034030", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-6chq-wfr3-2hj9"}, "properties": {"repobilityId": "8701b01c16dfda61", "scanner": "scanner-primary", "fingerprint": "fe6f7a845b034030", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6chq-wfr3-2hj9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77133eb2f94be75b", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-7q8q-rj6j-mhjq"}, "properties": {"repobilityId": "3d57cbca7f9e304c", "scanner": "scanner-primary", "fingerprint": "77133eb2f94be75b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7q8q-rj6j-mhjq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4a94c3a92dea47a", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-898c-q2cr-xwhg"}, "properties": {"repobilityId": "2d5dffbdcb83c776", "scanner": "scanner-primary", "fingerprint": "d4a94c3a92dea47a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-898c-q2cr-xwhg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b27a0210f29e588", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-8hc4-vh64-cxmj"}, "properties": {"repobilityId": "be0e770a73fc43a9", "scanner": "scanner-primary", "fingerprint": "5b27a0210f29e588", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8hc4-vh64-cxmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e82906273812d16f", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-fvcv-3m26-pcqx"}, "properties": {"repobilityId": "772424c1b97635e9", "scanner": "scanner-primary", "fingerprint": "e82906273812d16f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fvcv-3m26-pcqx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9aedc6c93b062737", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-hfxv-24rg-xrqf"}, "properties": {"repobilityId": "9271eb2eda5222e6", "scanner": "scanner-primary", "fingerprint": "9aedc6c93b062737", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hfxv-24rg-xrqf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e687085f0cef4b06", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-j5f8-grm9-p9fc"}, "properties": {"repobilityId": "81b4e18b5bf3150b", "scanner": "scanner-primary", "fingerprint": "e687085f0cef4b06", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j5f8-grm9-p9fc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d007e7f4f427d35", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-jr5f-v2jv-69x6"}, "properties": {"repobilityId": "d1ed8550835e5674", "scanner": "scanner-primary", "fingerprint": "6d007e7f4f427d35", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jr5f-v2jv-69x6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eaec676fafa18e1f", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-m7pr-hjqh-92cm"}, "properties": {"repobilityId": "de985c8eb10f672e", "scanner": "scanner-primary", "fingerprint": "eaec676fafa18e1f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m7pr-hjqh-92cm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6864905d949c9bd0", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-mmx7-hfxf-jppx"}, "properties": {"repobilityId": "64bfb4967b926933", "scanner": "scanner-primary", "fingerprint": "6864905d949c9bd0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mmx7-hfxf-jppx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf736d19777661eb", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-p92q-9vqr-4j8v"}, "properties": {"repobilityId": "515833aa3a8d3cf0", "scanner": "scanner-primary", "fingerprint": "cf736d19777661eb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p92q-9vqr-4j8v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02f27dca13834ea7", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-pf86-5x62-jrwf"}, "properties": {"repobilityId": "8366ec0fcc76e0fb", "scanner": "scanner-primary", "fingerprint": "02f27dca13834ea7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pf86-5x62-jrwf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93d430f7930acd5f", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-pmv8-rq9r-6j72"}, "properties": {"repobilityId": "9e4dec7b7f6cfefd", "scanner": "scanner-primary", "fingerprint": "93d430f7930acd5f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmv8-rq9r-6j72"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ba333e0183d700e", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-pmwg-cvhr-8vh7"}, "properties": {"repobilityId": "77df31349598aa3b", "scanner": "scanner-primary", "fingerprint": "3ba333e0183d700e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmwg-cvhr-8vh7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-720469e5ed351f11", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-q8qp-cvcw-x6jj"}, "properties": {"repobilityId": "1de73da546880291", "scanner": "scanner-primary", "fingerprint": "720469e5ed351f11", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q8qp-cvcw-x6jj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-041b33e868eef10d", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-vf2m-468p-8v99"}, "properties": {"repobilityId": "9212cf2b2a1cffa1", "scanner": "scanner-primary", "fingerprint": "041b33e868eef10d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vf2m-468p-8v99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b2267bb56f0e12d", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-w9j2-pvgh-6h63"}, "properties": {"repobilityId": "7e7e013d2fdcfdca", "scanner": "scanner-primary", "fingerprint": "0b2267bb56f0e12d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w9j2-pvgh-6h63"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ede949d78ce5755", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-wf5p-g6vw-rhxx"}, "properties": {"repobilityId": "cf34f202e7a6546a", "scanner": "scanner-primary", "fingerprint": "8ede949d78ce5755", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wf5p-g6vw-rhxx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8971c9333e028014", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-xhjh-pmcv-23jw"}, "properties": {"repobilityId": "46a25f7f5a178668", "scanner": "scanner-primary", "fingerprint": "8971c9333e028014", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xhjh-pmcv-23jw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6bb4f287996371a9", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.5.1: GHSA-xx6v-rp6x-q39c"}, "properties": {"repobilityId": "aa16f6cd8a9b203b", "scanner": "scanner-primary", "fingerprint": "6bb4f287996371a9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xx6v-rp6x-q39c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b4fcd5417adde9a", "level": "warning", "message": {"text": "Vulnerable dependency yaml 1.10.2: GHSA-48c2-rrv3-qjmp"}, "properties": {"repobilityId": "11ffc1659f321149", "scanner": "scanner-primary", "fingerprint": "5b4fcd5417adde9a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-48c2-rrv3-qjmp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d0ca920a49dafed", "level": "warning", "message": {"text": "Vulnerable dependency lodash 4.17.21: GHSA-f23m-r3pf-42rh"}, "properties": {"repobilityId": "cc4bf4eecb219236", "scanner": "scanner-primary", "fingerprint": "0d0ca920a49dafed", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f23m-r3pf-42rh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-333a1d60caf8245d", "level": "warning", "message": {"text": "Vulnerable dependency lodash 4.17.21: GHSA-r5fr-rjxr-66jc"}, "properties": {"repobilityId": "2b726702cde61827", "scanner": "scanner-primary", "fingerprint": "333a1d60caf8245d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r5fr-rjxr-66jc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66a3e5a69e463139", "level": "warning", "message": {"text": "Vulnerable dependency pdfjs-dist 3.11.174: GHSA-wgrm-67xf-hhpq"}, "properties": {"repobilityId": "8254a597a9fab916", "scanner": "scanner-primary", "fingerprint": "66a3e5a69e463139", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wgrm-67xf-hhpq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebf1ba408bccf060", "level": "warning", "message": {"text": "Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25"}, "properties": {"repobilityId": "e5ee531fac8ca248", "scanner": "scanner-primary", "fingerprint": "ebf1ba408bccf060", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v3m3-f69x-jf25"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d869c19d3ba10c0e", "level": "warning", "message": {"text": "Vulnerable dependency quill 1.3.7: GHSA-4943-9vgg-gr5r"}, "properties": {"repobilityId": "80c8a2772403295f", "scanner": "scanner-primary", "fingerprint": "d869c19d3ba10c0e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4943-9vgg-gr5r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-875544d9d6b0e344", "level": "warning", "message": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-2j2x-hqr9-3h42"}, "properties": {"repobilityId": "6fed18dc43936f7b", "scanner": "scanner-primary", "fingerprint": "875544d9d6b0e344", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2j2x-hqr9-3h42"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-599a4c9ceba98ad3", "level": "warning", "message": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-337j-9hxr-rhxg"}, "properties": {"repobilityId": "ec2b30b56bd2eb7e", "scanner": "scanner-primary", "fingerprint": "599a4c9ceba98ad3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-337j-9hxr-rhxg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f41a50e6ec22c01e", "level": "warning", "message": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-9jcx-v3wj-wh4m"}, "properties": {"repobilityId": "3d5353458a2f110c", "scanner": "scanner-primary", "fingerprint": "f41a50e6ec22c01e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9jcx-v3wj-wh4m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4fc3616bdd6c2d6", "level": "warning", "message": {"text": "Vulnerable dependency react-router 6.16.0: GHSA-wrjc-x8rr-h8h6"}, "properties": {"repobilityId": "c4f647e8253c4aeb", "scanner": "scanner-primary", "fingerprint": "a4fc3616bdd6c2d6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wrjc-x8rr-h8h6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18759297e8882abd", "level": "warning", "message": {"text": "Vulnerable dependency uuid 13.0.0: GHSA-w5hq-g745-h8pq"}, "properties": {"repobilityId": "00de2562f5f346b0", "scanner": "scanner-primary", "fingerprint": "18759297e8882abd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w5hq-g745-h8pq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa0a35de74c801c6", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "90685dbb72b15019", "scanner": "scanner-primary", "fingerprint": "aa0a35de74c801c6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39fd4869f48576c4", "level": "error", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "d9b9604813f5ec55", "scanner": "scanner-primary", "fingerprint": "39fd4869f48576c4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e4b2ca1478f49f0", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "6d8cd9b06e1669ff", "scanner": "scanner-primary", "fingerprint": "1e4b2ca1478f49f0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f77f20582517844", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.3.1: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "e918f17f602550fb", "scanner": "scanner-primary", "fingerprint": "2f77f20582517844", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-172958f0268d4a40", "level": "error", "message": {"text": "Vulnerable dependency vite 7.3.1: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "0c0fb8fcfc9a2711", "scanner": "scanner-primary", "fingerprint": "172958f0268d4a40", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ebfbff855e30a64", "level": "error", "message": {"text": "Vulnerable dependency vite 7.3.1: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "bc2f4b3a640a4eef", "scanner": "scanner-primary", "fingerprint": "1ebfbff855e30a64", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3dc59ee817f1ae1", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.3.1: GHSA-v2wj-q39q-566r"}, "properties": {"repobilityId": "6218f4560d531ff5", "scanner": "scanner-primary", "fingerprint": "b3dc59ee817f1ae1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2wj-q39q-566r", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0bfe31bbaf37ec9", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.3.1: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "e94069e1f72ac15f", "scanner": "scanner-primary", "fingerprint": "d0bfe31bbaf37ec9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83c5d3baceecefbf", "level": "error", "message": {"text": "Vulnerable dependency vitest 3.2.4: GHSA-5xrq-8626-4rwp"}, "properties": {"repobilityId": "03f0941ea6245514", "scanner": "scanner-primary", "fingerprint": "83c5d3baceecefbf", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5xrq-8626-4rwp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d67d6666e482eed1", "level": "warning", "message": {"text": "Vulnerable dependency vitest 3.2.4: GHSA-82fw-gwwq-j7x9"}, "properties": {"repobilityId": "331c15673f9365e5", "scanner": "scanner-primary", "fingerprint": "d67d6666e482eed1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-82fw-gwwq-j7x9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40eaa96c2e817982", "level": "warning", "message": {"text": "Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp"}, "properties": {"repobilityId": "05653192128144a2", "scanner": "scanner-primary", "fingerprint": "40eaa96c2e817982", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-48c2-rrv3-qjmp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d572baf8c7afebc", "level": "warning", "message": {"text": "Vulnerable dependency diff 8.0.2: GHSA-73rr-hh4g-fpgx"}, "properties": {"repobilityId": "699e2c9ad468fd68", "scanner": "scanner-primary", "fingerprint": "4d572baf8c7afebc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-73rr-hh4g-fpgx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59fe3b6f6a42c1fd", "level": "error", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-2h9g-j24r-h63g"}, "properties": {"repobilityId": "00a01fffe54637e1", "scanner": "scanner-primary", "fingerprint": "59fe3b6f6a42c1fd", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2h9g-j24r-h63g", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e4a82ffed0caf63", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-2w86-xfrc-g85r"}, "properties": {"repobilityId": "ae332ec80f6a7092", "scanner": "scanner-primary", "fingerprint": "8e4a82ffed0caf63", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2w86-xfrc-g85r", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4da0886d9f7259f1", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-3575-w9fc-c2j6"}, "properties": {"repobilityId": "99fce2ac2138ecd0", "scanner": "scanner-primary", "fingerprint": "4da0886d9f7259f1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3575-w9fc-c2j6", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e8b729402b92c0e", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-6437-gxhq-pqv8"}, "properties": {"repobilityId": "3e97afdcebf0a8db", "scanner": "scanner-primary", "fingerprint": "3e8b729402b92c0e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6437-gxhq-pqv8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f4e40d5510c9ce3", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-653q-5476-x79g"}, "properties": {"repobilityId": "b9e706f2ca02f603", "scanner": "scanner-primary", "fingerprint": "9f4e40d5510c9ce3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-653q-5476-x79g", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1e07975f5f576d6", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-6mr6-jvcr-2f25"}, "properties": {"repobilityId": "e15cf28f4de5904b", "scanner": "scanner-primary", "fingerprint": "b1e07975f5f576d6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6mr6-jvcr-2f25", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8b96ec117d44bf5", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-88f2-fpv8-89q2"}, "properties": {"repobilityId": "2e31b8ce4d671cef", "scanner": "scanner-primary", "fingerprint": "b8b96ec117d44bf5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-88f2-fpv8-89q2", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72e2f317533fe7ae", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-8j6p-r8jg-mxqh"}, "properties": {"repobilityId": "5e011e549f691911", "scanner": "scanner-primary", "fingerprint": "72e2f317533fe7ae", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8j6p-r8jg-mxqh", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c83c75aeb0bc37f", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-cxq5-97v7-87j8"}, "properties": {"repobilityId": "3d92650b44488e9f", "scanner": "scanner-primary", "fingerprint": "2c83c75aeb0bc37f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cxq5-97v7-87j8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f82178b9e92fa31", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-fg9p-mrxr-hvq7"}, "properties": {"repobilityId": "c4b756312763b7cb", "scanner": "scanner-primary", "fingerprint": "7f82178b9e92fa31", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fg9p-mrxr-hvq7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8769d4522ba9696e", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-p4cg-3328-rvfg"}, "properties": {"repobilityId": "6dfc4a8d60e9dce1", "scanner": "scanner-primary", "fingerprint": "8769d4522ba9696e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p4cg-3328-rvfg", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-722e96cd2a8abec2", "level": "warning", "message": {"text": "Vulnerable dependency orval 8.9.1: GHSA-w727-8j6c-2rj4"}, "properties": {"repobilityId": "a4273ad335aa6ab8", "scanner": "scanner-primary", "fingerprint": "722e96cd2a8abec2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w727-8j6c-2rj4", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d905048c2808c242", "level": "warning", "message": {"text": "Vulnerable dependency swiper 12.0.3: GHSA-hmx5-qpq5-p643"}, "properties": {"repobilityId": "1a4eaa67fb93528d", "scanner": "scanner-primary", "fingerprint": "d905048c2808c242", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hmx5-qpq5-p643"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-30d7f1538da86253", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "2ab463e8450d8b48", "scanner": "scanner-primary", "fingerprint": "30d7f1538da86253", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88519ae35c5cbb47", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7"}, "properties": {"repobilityId": "e7c1485156dd47b7", "scanner": "scanner-primary", "fingerprint": "88519ae35c5cbb47", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-93m4-6634-74q7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70ff31fd91e418d2", "level": "error", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "329b6b3287b01415", "scanner": "scanner-primary", "fingerprint": "70ff31fd91e418d2", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f08461cefacf5981", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c"}, "properties": {"repobilityId": "2c068265c3935c4a", "scanner": "scanner-primary", "fingerprint": "f08461cefacf5981", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g4jq-h2w9-997c", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-119d393ba096329e", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3"}, "properties": {"repobilityId": "33e5fe48fada6ea6", "scanner": "scanner-primary", "fingerprint": "119d393ba096329e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jqfw-vq24-v9c3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-473721b30482b1c3", "level": "error", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "eec867d958264465", "scanner": "scanner-primary", "fingerprint": "473721b30482b1c3", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c880e4bdced7e51", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "076b1a0ff43b915b", "scanner": "scanner-primary", "fingerprint": "8c880e4bdced7e51", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cedc44a881c24c7", "level": "error", "message": {"text": "Vulnerable dependency vitest 3.2.3: GHSA-5xrq-8626-4rwp"}, "properties": {"repobilityId": "d466684a2bcb56c8", "scanner": "scanner-primary", "fingerprint": "7cedc44a881c24c7", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5xrq-8626-4rwp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0efb5bbd3d4b7c4a", "level": "warning", "message": {"text": "Vulnerable dependency vitest 3.2.3: GHSA-82fw-gwwq-j7x9"}, "properties": {"repobilityId": "50f49665c1d3968d", "scanner": "scanner-primary", "fingerprint": "0efb5bbd3d4b7c4a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-82fw-gwwq-j7x9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b03368702ccf527", "level": "warning", "message": {"text": "Vulnerable dependency yaml 2.8.0: GHSA-48c2-rrv3-qjmp"}, "properties": {"repobilityId": "387c7656f3af5c45", "scanner": "scanner-primary", "fingerprint": "8b03368702ccf527", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-48c2-rrv3-qjmp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/yarn.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2ea1200dc42372a", "level": "warning", "message": {"text": "Vulnerable dependency anyio 4.12.1: GHSA-5p39-cfhj-2xmp"}, "properties": {"repobilityId": "2e40154ff5ddcbe1", "scanner": "scanner-primary", "fingerprint": "f2ea1200dc42372a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5p39-cfhj-2xmp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8608d866f1da5328", "level": "warning", "message": {"text": "Vulnerable dependency anyio 4.12.1: GHSA-82r6-8w77-94w6"}, "properties": {"repobilityId": "ed8714ffc4dcb319", "scanner": "scanner-primary", "fingerprint": "8608d866f1da5328", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-82r6-8w77-94w6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e863fe78861504ae", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-7432-952r-cw78"}, "properties": {"repobilityId": "103bc38abec3d7aa", "scanner": "scanner-primary", "fingerprint": "e863fe78861504ae", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7432-952r-cw78"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76455d35f1bf7907", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-7wc2-qxgw-g8gg"}, "properties": {"repobilityId": "98504ab3ddbeb1ff", "scanner": "scanner-primary", "fingerprint": "76455d35f1bf7907", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7wc2-qxgw-g8gg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27713ce10260788e", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-jj8c-mmj3-mmgv"}, "properties": {"repobilityId": "9ed05c97c426f270", "scanner": "scanner-primary", "fingerprint": "27713ce10260788e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jj8c-mmj3-mmgv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca0170f658ff97f6", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-m344-f55w-2m6j"}, "properties": {"repobilityId": "fbf0a9e7ffa3a5e1", "scanner": "scanner-primary", "fingerprint": "ca0170f658ff97f6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m344-f55w-2m6j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5899ed92cd9b2cc1", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-r95x-qfjj-fjj2"}, "properties": {"repobilityId": "dc7f8b04098f256f", "scanner": "scanner-primary", "fingerprint": "5899ed92cd9b2cc1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r95x-qfjj-fjj2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecfae77eead2c00d", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-w8p2-r796-3vmq"}, "properties": {"repobilityId": "d058f6b55c2462b8", "scanner": "scanner-primary", "fingerprint": "ecfae77eead2c00d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w8p2-r796-3vmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b3378b380456fa2", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: GHSA-wvwj-cvrp-7pv5"}, "properties": {"repobilityId": "aab01c79571a659e", "scanner": "scanner-primary", "fingerprint": "6b3378b380456fa2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wvwj-cvrp-7pv5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c109ed9c5a2c03b4", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-188"}, "properties": {"repobilityId": "30f52b619bd16721", "scanner": "scanner-primary", "fingerprint": "c109ed9c5a2c03b4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-188"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6042d02e70a94ee6", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2116"}, "properties": {"repobilityId": "02eb87ca6b5d9513", "scanner": "scanner-primary", "fingerprint": "6042d02e70a94ee6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2116"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de86bc708a166525", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2117"}, "properties": {"repobilityId": "677e1e53b88a3a10", "scanner": "scanner-primary", "fingerprint": "de86bc708a166525", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2117"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16ce6b3a4d59b645", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2118"}, "properties": {"repobilityId": "564e1e17b5180ff7", "scanner": "scanner-primary", "fingerprint": "16ce6b3a4d59b645", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2118"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec9b20a639737459", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-2119"}, "properties": {"repobilityId": "f096b45bcbad79bd", "scanner": "scanner-primary", "fingerprint": "ec9b20a639737459", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2119"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8da3065f8b6a5d57", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-25"}, "properties": {"repobilityId": "a35b7c5e73af69a4", "scanner": "scanner-primary", "fingerprint": "8da3065f8b6a5d57", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-25"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c16cd705cad25385", "level": "warning", "message": {"text": "Vulnerable dependency authlib 1.6.6: PYSEC-2026-287"}, "properties": {"repobilityId": "e11ed1183f289ac3", "scanner": "scanner-primary", "fingerprint": "c16cd705cad25385", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-287"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efcadeb417bd31cd", "level": "warning", "message": {"text": "Vulnerable dependency cbor2 5.8.0: GHSA-3c37-wwvx-h642"}, "properties": {"repobilityId": "e811b06ae66ebaf3", "scanner": "scanner-primary", "fingerprint": "efcadeb417bd31cd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3c37-wwvx-h642"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc7605893f7c9ef4", "level": "warning", "message": {"text": "Vulnerable dependency cbor2 5.8.0: PYSEC-2026-2123"}, "properties": {"repobilityId": "3819bd2f32f96204", "scanner": "scanner-primary", "fingerprint": "fc7605893f7c9ef4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2123"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e478839f26ffd88", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-2wm9-hf6c-p5cr"}, "properties": {"repobilityId": "b3ec4ed6a69992d6", "scanner": "scanner-primary", "fingerprint": "7e478839f26ffd88", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2wm9-hf6c-p5cr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-678ab084567ec5a2", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-36p7-vc44-83pf"}, "properties": {"repobilityId": "eb80b7a5996a6102", "scanner": "scanner-primary", "fingerprint": "678ab084567ec5a2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-36p7-vc44-83pf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-255aa05b8e8f6b85", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-f4j7-r4q5-qw2c"}, "properties": {"repobilityId": "67de10746eb93f6f", "scanner": "scanner-primary", "fingerprint": "255aa05b8e8f6b85", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f4j7-r4q5-qw2c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c3d2a46034e3c48", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: GHSA-xph7-9rjv-w5fr"}, "properties": {"repobilityId": "c268e93571f70f5f", "scanner": "scanner-primary", "fingerprint": "6c3d2a46034e3c48", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xph7-9rjv-w5fr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d93776cb1417946d", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-311"}, "properties": {"repobilityId": "8188c514449be5ac", "scanner": "scanner-primary", "fingerprint": "d93776cb1417946d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-311"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-866f9773be58f40d", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3813"}, "properties": {"repobilityId": "b55ffe6588658132", "scanner": "scanner-primary", "fingerprint": "866f9773be58f40d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3813"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98d2af2be2c7c0fb", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3814"}, "properties": {"repobilityId": "ee0400ec81282cbb", "scanner": "scanner-primary", "fingerprint": "98d2af2be2c7c0fb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3814"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-402fc07a1908eeea", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.5: PYSEC-2026-3815"}, "properties": {"repobilityId": "105c7a920fa6540a", "scanner": "scanner-primary", "fingerprint": "402fc07a1908eeea", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3815"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc5b28292b32ab72", "level": "warning", "message": {"text": "Vulnerable dependency click 8.3.1: PYSEC-2026-2132"}, "properties": {"repobilityId": "346057e715e4d8e2", "scanner": "scanner-primary", "fingerprint": "dc5b28292b32ab72", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2132"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a424d684507cc6f6", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-537c-gmf6-5ccf"}, "properties": {"repobilityId": "a9fda834958707e5", "scanner": "scanner-primary", "fingerprint": "a424d684507cc6f6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-537c-gmf6-5ccf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb7b891a057ab2a1", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-g6cj-pr64-35w5"}, "properties": {"repobilityId": "1f5157510c7d8420", "scanner": "scanner-primary", "fingerprint": "bb7b891a057ab2a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g6cj-pr64-35w5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6663d86673f3179c", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-jwv3-5hgf-82ww"}, "properties": {"repobilityId": "a2739ea3b3af03a5", "scanner": "scanner-primary", "fingerprint": "6663d86673f3179c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jwv3-5hgf-82ww"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16a4fec265d6dc32", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-m2h6-j472-rp4c"}, "properties": {"repobilityId": "0d427ea4fa2af9b3", "scanner": "scanner-primary", "fingerprint": "16a4fec265d6dc32", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m2h6-j472-rp4c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3e92d58081c05f7", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-m959-cc7f-wv43"}, "properties": {"repobilityId": "4f3921468c8a7081", "scanner": "scanner-primary", "fingerprint": "e3e92d58081c05f7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m959-cc7f-wv43"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68d1bf30b6aef8d1", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: GHSA-p423-j2cm-9vmq"}, "properties": {"repobilityId": "aeea12638156168c", "scanner": "scanner-primary", "fingerprint": "68d1bf30b6aef8d1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p423-j2cm-9vmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bce077408386b4b0", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-35"}, "properties": {"repobilityId": "5fc422dfe1001d48", "scanner": "scanner-primary", "fingerprint": "bce077408386b4b0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-35"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e7f97d0cb4bd799", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3552"}, "properties": {"repobilityId": "c63d0dba97e48cd8", "scanner": "scanner-primary", "fingerprint": "2e7f97d0cb4bd799", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3552"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe78358c1050a360", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3553"}, "properties": {"repobilityId": "8e1ed5f0401759c4", "scanner": "scanner-primary", "fingerprint": "fe78358c1050a360", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3553"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3ceae6aa0150409", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-3554"}, "properties": {"repobilityId": "89712d3833ff014b", "scanner": "scanner-primary", "fingerprint": "b3ceae6aa0150409", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3554"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-238ab6293a0a1fa2", "level": "warning", "message": {"text": "Vulnerable dependency cryptography 46.0.5: PYSEC-2026-36"}, "properties": {"repobilityId": "49e38ea699ba8b38", "scanner": "scanner-primary", "fingerprint": "238ab6293a0a1fa2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-36"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb7836d22a4800f7", "level": "warning", "message": {"text": "Vulnerable dependency datasets 4.5.0: PYSEC-2026-3716"}, "properties": {"repobilityId": "5409ccf785a56c3a", "scanner": "scanner-primary", "fingerprint": "eb7836d22a4800f7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3716"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d1c450675a10f57", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-3h9f-r86x-qvjx"}, "properties": {"repobilityId": "b38e1de18d905fe4", "scanner": "scanner-primary", "fingerprint": "1d1c450675a10f57", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3h9f-r86x-qvjx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4085a017925e31c5", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-6w2r-r2m5-xq5w"}, "properties": {"repobilityId": "2cb7643464869e10", "scanner": "scanner-primary", "fingerprint": "4085a017925e31c5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6w2r-r2m5-xq5w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5fe071f1afd98aca", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-7xr5-9hcq-chf9"}, "properties": {"repobilityId": "699a9977eed1fd10", "scanner": "scanner-primary", "fingerprint": "5fe071f1afd98aca", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7xr5-9hcq-chf9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8380acdc8c6edbe", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-8cjm-8mp7-r2xf"}, "properties": {"repobilityId": "44e0e29f90bee06a", "scanner": "scanner-primary", "fingerprint": "c8380acdc8c6edbe", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8cjm-8mp7-r2xf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec75bddfad27cf65", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-8j24-cjrq-gr2m"}, "properties": {"repobilityId": "95f33e142dccf391", "scanner": "scanner-primary", "fingerprint": "ec75bddfad27cf65", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8j24-cjrq-gr2m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cce83aa9dcf4200b", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-8qcx-xf44-272x"}, "properties": {"repobilityId": "baf49c8838edfa23", "scanner": "scanner-primary", "fingerprint": "cce83aa9dcf4200b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8qcx-xf44-272x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-366eb04e56638a98", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-923m-gv2p-w5qp"}, "properties": {"repobilityId": "b9b9582ff0a527c6", "scanner": "scanner-primary", "fingerprint": "366eb04e56638a98", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-923m-gv2p-w5qp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c5180fd1bc1e598", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-crhf-3pfg-w68w"}, "properties": {"repobilityId": "2de5b00da102da92", "scanner": "scanner-primary", "fingerprint": "5c5180fd1bc1e598", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-crhf-3pfg-w68w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4dc4e20b47667cd", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-frmv-pr5f-9mcr"}, "properties": {"repobilityId": "88615ed14fbb100d", "scanner": "scanner-primary", "fingerprint": "a4dc4e20b47667cd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-frmv-pr5f-9mcr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab6605aa93ac88cb", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-h7pc-vwp9-298g"}, "properties": {"repobilityId": "72ea9d3f13de5391", "scanner": "scanner-primary", "fingerprint": "ab6605aa93ac88cb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h7pc-vwp9-298g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5fa8ca9ddd2cfb60", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-hpr9-3m2g-3j9p"}, "properties": {"repobilityId": "f6e2c71a2065a919", "scanner": "scanner-primary", "fingerprint": "5fa8ca9ddd2cfb60", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hpr9-3m2g-3j9p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6bd1aebbae6cd1a4", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-q95w-c7qg-hrff"}, "properties": {"repobilityId": "1a4d0f0d94c8c93a", "scanner": "scanner-primary", "fingerprint": "6bd1aebbae6cd1a4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q95w-c7qg-hrff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d673e9d136f7b0a6", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-qw25-v68c-qjf3"}, "properties": {"repobilityId": "0d45dd4df2f09bf8", "scanner": "scanner-primary", "fingerprint": "d673e9d136f7b0a6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qw25-v68c-qjf3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac1904e3dd2f82a9", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-rqw2-ghq9-44m7"}, "properties": {"repobilityId": "c28e7f8a546dcb91", "scanner": "scanner-primary", "fingerprint": "ac1904e3dd2f82a9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rqw2-ghq9-44m7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-313d9add591eff63", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: GHSA-vrcr-9hj9-jcg6"}, "properties": {"repobilityId": "8fab15163a4cf598", "scanner": "scanner-primary", "fingerprint": "313d9add591eff63", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vrcr-9hj9-jcg6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25c199d6f9b78f0c", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-104"}, "properties": {"repobilityId": "f466ecd8296ce051", "scanner": "scanner-primary", "fingerprint": "25c199d6f9b78f0c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-104"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9da8aa8ac656b1c3", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-105"}, "properties": {"repobilityId": "0331cdc50556192b", "scanner": "scanner-primary", "fingerprint": "9da8aa8ac656b1c3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-105"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b877cf8414cb36e7", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-106"}, "properties": {"repobilityId": "1ee9c08ba8d24494", "scanner": "scanner-primary", "fingerprint": "b877cf8414cb36e7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-106"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9313d37391201aee", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-107"}, "properties": {"repobilityId": "12293cd753e147c9", "scanner": "scanner-primary", "fingerprint": "9313d37391201aee", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-107"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bafaf767ef69aa37", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-108"}, "properties": {"repobilityId": "6b82dfa853df4227", "scanner": "scanner-primary", "fingerprint": "bafaf767ef69aa37", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-108"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-601fba396b4fbdf2", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-109"}, "properties": {"repobilityId": "1bb30b482f6add03", "scanner": "scanner-primary", "fingerprint": "601fba396b4fbdf2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-109"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2eb31cc9fdce344", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-37"}, "properties": {"repobilityId": "cee4d202e9cfe22d", "scanner": "scanner-primary", "fingerprint": "b2eb31cc9fdce344", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-37"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d7815b63793e15a", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2025-47"}, "properties": {"repobilityId": "ea8b07126f857629", "scanner": "scanner-primary", "fingerprint": "5d7815b63793e15a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-47"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2333dd2863447297", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2026-1296"}, "properties": {"repobilityId": "30159ee20cbe3f29", "scanner": "scanner-primary", "fingerprint": "2333dd2863447297", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1296"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d17bef3eece3aa1", "level": "warning", "message": {"text": "Vulnerable dependency django 5.1.8: PYSEC-2026-3717"}, "properties": {"repobilityId": "d60b9d0d3aeaa7f7", "scanner": "scanner-primary", "fingerprint": "5d17bef3eece3aa1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3717"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea33d166d39df4d0", "level": "warning", "message": {"text": "Vulnerable dependency djangorestframework 3.16.1: GHSA-2m8g-3cmr-wg3w"}, "properties": {"repobilityId": "41896a22d9ee147f", "scanner": "scanner-primary", "fingerprint": "ea33d166d39df4d0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2m8g-3cmr-wg3w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b048def1967efc88", "level": "warning", "message": {"text": "Vulnerable dependency djangorestframework 3.16.1: GHSA-g47c-3xmw-q6m2"}, "properties": {"repobilityId": "3960959903bf2b5b", "scanner": "scanner-primary", "fingerprint": "b048def1967efc88", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g47c-3xmw-q6m2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-580aefbb35e777a3", "level": "warning", "message": {"text": "Vulnerable dependency djangorestframework 3.16.1: PYSEC-2026-3827"}, "properties": {"repobilityId": "7ec59f97170bc469", "scanner": "scanner-primary", "fingerprint": "580aefbb35e777a3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3827"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7120e473ddda950", "level": "warning", "message": {"text": "Vulnerable dependency djangorestframework 3.16.1: PYSEC-2026-3828"}, "properties": {"repobilityId": "137637ad6c6f642e", "scanner": "scanner-primary", "fingerprint": "f7120e473ddda950", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3828"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47ac4376d113364b", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-9f5j-8jwj-x28g"}, "properties": {"repobilityId": "26e293feeb8535dd", "scanner": "scanner-primary", "fingerprint": "47ac4376d113364b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9f5j-8jwj-x28g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61293a37b345ad68", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-wj6h-64fc-37mp"}, "properties": {"repobilityId": "76d5073459c98116", "scanner": "scanner-primary", "fingerprint": "61293a37b345ad68", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wj6h-64fc-37mp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e221a07e02838af8", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-1325"}, "properties": {"repobilityId": "1f58a4102bf62353", "scanner": "scanner-primary", "fingerprint": "e221a07e02838af8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1325"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-266906c069d9b55a", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-2467"}, "properties": {"repobilityId": "350d37c3173198b5", "scanner": "scanner-primary", "fingerprint": "266906c069d9b55a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2467"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf1386208c90609e", "level": "warning", "message": {"text": "Vulnerable dependency granian 2.6.1: GHSA-f5p7-9fr5-8jmj"}, "properties": {"repobilityId": "08d2ce15ad7c78f3", "scanner": "scanner-primary", "fingerprint": "cf1386208c90609e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f5p7-9fr5-8jmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c297730604be27ab", "level": "warning", "message": {"text": "Vulnerable dependency granian 2.6.1: GHSA-vrg7-482j-p6f6"}, "properties": {"repobilityId": "f07044b879059edf", "scanner": "scanner-primary", "fingerprint": "c297730604be27ab", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vrg7-482j-p6f6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3994b99817b904c", "level": "warning", "message": {"text": "Vulnerable dependency granian 2.6.1: PYSEC-2026-2502"}, "properties": {"repobilityId": "a862e22b715f10de", "scanner": "scanner-primary", "fingerprint": "f3994b99817b904c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2502"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c05271357dfbb89", "level": "warning", "message": {"text": "Vulnerable dependency granian 2.6.1: PYSEC-2026-2503"}, "properties": {"repobilityId": "b061153e0806a723", "scanner": "scanner-primary", "fingerprint": "3c05271357dfbb89", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2503"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-568a970c74e3d57f", "level": "warning", "message": {"text": "Vulnerable dependency h2 4.3.0: GHSA-6hr6-w5qg-qmwg"}, "properties": {"repobilityId": "0b7cfbf26dddbd4c", "scanner": "scanner-primary", "fingerprint": "568a970c74e3d57f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6hr6-w5qg-qmwg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2852c8e8158a0ddb", "level": "warning", "message": {"text": "Vulnerable dependency h2 4.3.0: PYSEC-2026-3628"}, "properties": {"repobilityId": "2d78bf562a1fe0bb", "scanner": "scanner-primary", "fingerprint": "2852c8e8158a0ddb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3628"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-19f24560e2ed778e", "level": "warning", "message": {"text": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx"}, "properties": {"repobilityId": "fb9a242b2a48123b", "scanner": "scanner-primary", "fingerprint": "19f24560e2ed778e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-65pc-fj4g-8rjx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67fa3cbc85b501c4", "level": "warning", "message": {"text": "Vulnerable dependency idna 3.11: PYSEC-2026-215"}, "properties": {"repobilityId": "b8ede6cf01a2d587", "scanner": "scanner-primary", "fingerprint": "67fa3cbc85b501c4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-215"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfea5c42ae464abb", "level": "warning", "message": {"text": "Vulnerable dependency json-repair 0.55.0: GHSA-xf7x-x43h-rpqh"}, "properties": {"repobilityId": "8d0a3338d41e780b", "scanner": "scanner-primary", "fingerprint": "cfea5c42ae464abb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xf7x-x43h-rpqh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4982964d7c9a9b6f", "level": "error", "message": {"text": "Vulnerable dependency langchain 0.3.27: GHSA-3644-q5cj-c5c7"}, "properties": {"repobilityId": "66415a8488a12d3d", "scanner": "scanner-primary", "fingerprint": "4982964d7c9a9b6f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3644-q5cj-c5c7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-607cc7cc56e156c8", "level": "warning", "message": {"text": "Vulnerable dependency langchain 0.3.27: GHSA-gr75-jv2w-4656"}, "properties": {"repobilityId": "f21081b93021e678", "scanner": "scanner-primary", "fingerprint": "607cc7cc56e156c8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gr75-jv2w-4656"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6978204b51035df2", "level": "warning", "message": {"text": "Vulnerable dependency langchain 0.3.27: PYSEC-2026-2192"}, "properties": {"repobilityId": "d3f1e7f64a283d07", "scanner": "scanner-primary", "fingerprint": "6978204b51035df2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2192"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77e84adba9852df7", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-2g6r-c272-w58r"}, "properties": {"repobilityId": "d924ebcd523c8f92", "scanner": "scanner-primary", "fingerprint": "77e84adba9852df7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2g6r-c272-w58r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-064c062d417bdcc0", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-926x-3r5x-gfhw"}, "properties": {"repobilityId": "6e53c01897f00461", "scanner": "scanner-primary", "fingerprint": "064c062d417bdcc0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-926x-3r5x-gfhw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62366c73bed00a1c", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-pjwx-r37v-7724"}, "properties": {"repobilityId": "68f17d663d4ea920", "scanner": "scanner-primary", "fingerprint": "62366c73bed00a1c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pjwx-r37v-7724"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ec90f7df1402a1", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: GHSA-qh6h-p6c9-ff54"}, "properties": {"repobilityId": "e509f46f4b3be2ab", "scanner": "scanner-primary", "fingerprint": "53ec90f7df1402a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qh6h-p6c9-ff54"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6619ff5dda31268", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2193"}, "properties": {"repobilityId": "cf88458d3b5a3a44", "scanner": "scanner-primary", "fingerprint": "c6619ff5dda31268", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2193"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9d01713cea3d630", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2563"}, "properties": {"repobilityId": "30b751e141dea4cc", "scanner": "scanner-primary", "fingerprint": "c9d01713cea3d630", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2563"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0dcf3ee72ef690db", "level": "warning", "message": {"text": "Vulnerable dependency langchain-core 0.3.83: PYSEC-2026-2564"}, "properties": {"repobilityId": "f44c54b8a58a785e", "scanner": "scanner-primary", "fingerprint": "0dcf3ee72ef690db", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2564"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a698457206fe066", "level": "warning", "message": {"text": "Vulnerable dependency langchain-text-splitters 0.3.11: GHSA-fv5p-p927-qmxr"}, "properties": {"repobilityId": "fe410624886a8d6f", "scanner": "scanner-primary", "fingerprint": "8a698457206fe066", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fv5p-p927-qmxr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1af9cfef6024f94a", "level": "warning", "message": {"text": "Vulnerable dependency langchain-text-splitters 0.3.11: PYSEC-2026-77"}, "properties": {"repobilityId": "be822747fd985874", "scanner": "scanner-primary", "fingerprint": "1af9cfef6024f94a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-77"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-230809427914f14a", "level": "error", "message": {"text": "Vulnerable dependency langsmith 0.6.3: GHSA-3644-q5cj-c5c7"}, "properties": {"repobilityId": "6fb9ba5e69a24f2e", "scanner": "scanner-primary", "fingerprint": "230809427914f14a", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3644-q5cj-c5c7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e215dee1005bbe18", "level": "warning", "message": {"text": "Vulnerable dependency langsmith 0.6.3: GHSA-f4xh-w4cj-qxq8"}, "properties": {"repobilityId": "72c2e35c28b77e7d", "scanner": "scanner-primary", "fingerprint": "e215dee1005bbe18", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f4xh-w4cj-qxq8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5dc30cf304f450de", "level": "warning", "message": {"text": "Vulnerable dependency langsmith 0.6.3: GHSA-rr7j-v2q5-chgv"}, "properties": {"repobilityId": "6e1c320d43dcbf86", "scanner": "scanner-primary", "fingerprint": "5dc30cf304f450de", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rr7j-v2q5-chgv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0281fa4a6697b10d", "level": "warning", "message": {"text": "Vulnerable dependency langsmith 0.6.3: PYSEC-2026-2583"}, "properties": {"repobilityId": "b2682384dccfb6cb", "scanner": "scanner-primary", "fingerprint": "0281fa4a6697b10d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2583"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8b3edb6c6bc5941", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-4g5m-c9r5-49xf"}, "properties": {"repobilityId": "4ec6dff3cb66cb9d", "scanner": "scanner-primary", "fingerprint": "c8b3edb6c6bc5941", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4g5m-c9r5-49xf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90256721ba383958", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-4jcj-7x88-m979"}, "properties": {"repobilityId": "20c0ed0aac19aba0", "scanner": "scanner-primary", "fingerprint": "90256721ba383958", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4jcj-7x88-m979"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0e86f65d4efe6b8", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-4xpc-pv4p-pm3w"}, "properties": {"repobilityId": "2a9f9ea79b128ac1", "scanner": "scanner-primary", "fingerprint": "f0e86f65d4efe6b8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4xpc-pv4p-pm3w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08239e1b4773558c", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-53mr-6c8q-9789"}, "properties": {"repobilityId": "2459d53a5af1bd76", "scanner": "scanner-primary", "fingerprint": "08239e1b4773558c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-53mr-6c8q-9789"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a764c14709b66e8f", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-5jmr-gcrj-2c9q"}, "properties": {"repobilityId": "1a2174da33162a47", "scanner": "scanner-primary", "fingerprint": "a764c14709b66e8f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5jmr-gcrj-2c9q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cddc1ec0c76a184", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-69x8-hrgq-fjj8"}, "properties": {"repobilityId": "3ce356c0b76338b7", "scanner": "scanner-primary", "fingerprint": "4cddc1ec0c76a184", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-69x8-hrgq-fjj8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae550fda9ed7f87c", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-6wvf-77m9-58rm"}, "properties": {"repobilityId": "390de880d916570a", "scanner": "scanner-primary", "fingerprint": "ae550fda9ed7f87c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6wvf-77m9-58rm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e5e8f0f156c52ee", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-72m8-9m7m-h278"}, "properties": {"repobilityId": "b7802027f6de9461", "scanner": "scanner-primary", "fingerprint": "5e5e8f0f156c52ee", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-72m8-9m7m-h278"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da31848e7d664e3b", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-7488-6r32-c95q"}, "properties": {"repobilityId": "bde23f141d0ad489", "scanner": "scanner-primary", "fingerprint": "da31848e7d664e3b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7488-6r32-c95q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48db989c05caad7f", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-c693-x898-5g4h"}, "properties": {"repobilityId": "62d03dbc71d429bf", "scanner": "scanner-primary", "fingerprint": "48db989c05caad7f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-c693-x898-5g4h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7a76c57f9847f31", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-hx8v-g79f-8w5f"}, "properties": {"repobilityId": "f9ed6bb33bbc4c6b", "scanner": "scanner-primary", "fingerprint": "a7a76c57f9847f31", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hx8v-g79f-8w5f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5fe9604c4782094", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-j37q-q7p9-vpwm"}, "properties": {"repobilityId": "a35961ff5c8f4147", "scanner": "scanner-primary", "fingerprint": "d5fe9604c4782094", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j37q-q7p9-vpwm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d88837eb870ae8e", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-jjhc-v7c2-5hh6"}, "properties": {"repobilityId": "b9e1d3243fb2cae2", "scanner": "scanner-primary", "fingerprint": "3d88837eb870ae8e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jjhc-v7c2-5hh6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02b9f7a84ccafed6", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-m2v5-74w2-qhcj"}, "properties": {"repobilityId": "cc42a00529123494", "scanner": "scanner-primary", "fingerprint": "02b9f7a84ccafed6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m2v5-74w2-qhcj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-690380538513fa56", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-mf52-j94g-746m"}, "properties": {"repobilityId": "cc2854deb77ee557", "scanner": "scanner-primary", "fingerprint": "690380538513fa56", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mf52-j94g-746m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-476f71eb96dd30a1", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-p897-vf7j-f5h8"}, "properties": {"repobilityId": "b9b912f73e336ef0", "scanner": "scanner-primary", "fingerprint": "476f71eb96dd30a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p897-vf7j-f5h8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f0d8b2214b27ab3", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-qmf3-4767-5fg3"}, "properties": {"repobilityId": "745b730152bf5ed9", "scanner": "scanner-primary", "fingerprint": "5f0d8b2214b27ab3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qmf3-4767-5fg3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12551f42e7194192", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-qrc4-49gv-mv9m"}, "properties": {"repobilityId": "68c1d73db3be331d", "scanner": "scanner-primary", "fingerprint": "12551f42e7194192", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qrc4-49gv-mv9m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b94e35d9acc800b", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-v4p8-mg3p-g94g"}, "properties": {"repobilityId": "8a6760e170463b86", "scanner": "scanner-primary", "fingerprint": "0b94e35d9acc800b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v4p8-mg3p-g94g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a300d2d0af7f809", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-w2mh-qq9q-453x"}, "properties": {"repobilityId": "5835884018a94ab0", "scanner": "scanner-primary", "fingerprint": "2a300d2d0af7f809", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w2mh-qq9q-453x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd08376d9961d535", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-wpfp-gwwc-vwq6"}, "properties": {"repobilityId": "867487fe48eb31b7", "scanner": "scanner-primary", "fingerprint": "fd08376d9961d535", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wpfp-gwwc-vwq6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4478b3b8798be3a8", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-wxxx-gvqv-xp7p"}, "properties": {"repobilityId": "fc4e9b914bb8c75e", "scanner": "scanner-primary", "fingerprint": "4478b3b8798be3a8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wxxx-gvqv-xp7p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff51d131c412be8f", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: GHSA-xqmj-j6mv-4862"}, "properties": {"repobilityId": "3c6a58f0cc8ca0e9", "scanner": "scanner-primary", "fingerprint": "ff51d131c412be8f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xqmj-j6mv-4862"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b778fe8e888e95ea", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2597"}, "properties": {"repobilityId": "10c3963e4d8e4b37", "scanner": "scanner-primary", "fingerprint": "b778fe8e888e95ea", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2597"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a70f0372f242e38d", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2598"}, "properties": {"repobilityId": "e360497da28cb35f", "scanner": "scanner-primary", "fingerprint": "a70f0372f242e38d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2598"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe98d42f900cf179", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2599"}, "properties": {"repobilityId": "588f5283a20d9d9f", "scanner": "scanner-primary", "fingerprint": "fe98d42f900cf179", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2599"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07a5d7eb3c8a1d8f", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2600"}, "properties": {"repobilityId": "da91d8f2692885d6", "scanner": "scanner-primary", "fingerprint": "07a5d7eb3c8a1d8f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2600"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfa467d59a6ceac3", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2601"}, "properties": {"repobilityId": "94150b60b915aa55", "scanner": "scanner-primary", "fingerprint": "cfa467d59a6ceac3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2601"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41c4d6c149a31e2d", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-2602"}, "properties": {"repobilityId": "5229472ff3c93c9b", "scanner": "scanner-primary", "fingerprint": "41c4d6c149a31e2d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2602"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4888092397845aab", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3476"}, "properties": {"repobilityId": "cc8e90d6eab20a51", "scanner": "scanner-primary", "fingerprint": "4888092397845aab", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3476"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-def444df5ecd395d", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3477"}, "properties": {"repobilityId": "0b5ddf667cdb1a06", "scanner": "scanner-primary", "fingerprint": "def444df5ecd395d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3477"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-152f1d392d2d05e8", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3478"}, "properties": {"repobilityId": "c0c1af8061f87b4d", "scanner": "scanner-primary", "fingerprint": "152f1d392d2d05e8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3478"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5979a23d310b5dae", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3479"}, "properties": {"repobilityId": "15160bc96ee7331e", "scanner": "scanner-primary", "fingerprint": "5979a23d310b5dae", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3479"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee750379a844b92f", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-3861"}, "properties": {"repobilityId": "cd1327daefe41a1d", "scanner": "scanner-primary", "fingerprint": "ee750379a844b92f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3861"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b99bf6ec8fb65df", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-388"}, "properties": {"repobilityId": "a391101126d3ff87", "scanner": "scanner-primary", "fingerprint": "2b99bf6ec8fb65df", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-388"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b948936725b4d7cc", "level": "warning", "message": {"text": "Vulnerable dependency litellm 1.81.11: PYSEC-2026-390"}, "properties": {"repobilityId": "5e1577b7f12e647f", "scanner": "scanner-primary", "fingerprint": "b948936725b4d7cc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-390"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01ec0d7c96c39e03", "level": "warning", "message": {"text": "Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw"}, "properties": {"repobilityId": "683b60e1b81ffebe", "scanner": "scanner-primary", "fingerprint": "01ec0d7c96c39e03", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vfmq-68hx-4jfw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54c5acac7af14333", "level": "warning", "message": {"text": "Vulnerable dependency lxml 6.0.2: PYSEC-2026-87"}, "properties": {"repobilityId": "b8cac1718ed3ecae", "scanner": "scanner-primary", "fingerprint": "54c5acac7af14333", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-87"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a61d3afafcb77fd", "level": "error", "message": {"text": "Vulnerable dependency mako 1.3.10: GHSA-2h4p-vjrc-8xpq"}, "properties": {"repobilityId": "1f658dc24169754b", "scanner": "scanner-primary", "fingerprint": "6a61d3afafcb77fd", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2h4p-vjrc-8xpq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d11a2dd46069dad", "level": "warning", "message": {"text": "Vulnerable dependency mako 1.3.10: GHSA-v92g-xgxw-vvmm"}, "properties": {"repobilityId": "91dc1ff4e89696b7", "scanner": "scanner-primary", "fingerprint": "6d11a2dd46069dad", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v92g-xgxw-vvmm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87f353c24cbb68d6", "level": "warning", "message": {"text": "Vulnerable dependency mako 1.3.10: PYSEC-2026-88"}, "properties": {"repobilityId": "d1793c9d424e7de1", "scanner": "scanner-primary", "fingerprint": "87f353c24cbb68d6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-88"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5787459ac28367f", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.26.0: GHSA-hvrp-rf83-w775"}, "properties": {"repobilityId": "372a3eab7c0415af", "scanner": "scanner-primary", "fingerprint": "d5787459ac28367f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hvrp-rf83-w775"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f9580253d214148", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.26.0: GHSA-jpw9-pfvf-9f58"}, "properties": {"repobilityId": "b1057d1f32458bbd", "scanner": "scanner-primary", "fingerprint": "3f9580253d214148", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jpw9-pfvf-9f58"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89abfc399bf79896", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.26.0: GHSA-vj7q-gjh5-988w"}, "properties": {"repobilityId": "131e03c60523a66a", "scanner": "scanner-primary", "fingerprint": "89abfc399bf79896", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vj7q-gjh5-988w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0771fe1bef6e9d5a", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3481"}, "properties": {"repobilityId": "64420dfe890022e2", "scanner": "scanner-primary", "fingerprint": "0771fe1bef6e9d5a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3481"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8ba3e867f93c0eb", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3482"}, "properties": {"repobilityId": "5d0c0e703af632a8", "scanner": "scanner-primary", "fingerprint": "e8ba3e867f93c0eb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3482"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d851315053ac2334", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.26.0: PYSEC-2026-3483"}, "properties": {"repobilityId": "7987c6d2f17744d9", "scanner": "scanner-primary", "fingerprint": "d851315053ac2334", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3483"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f8b50c352db88e9", "level": "warning", "message": {"text": "Vulnerable dependency msgpack 1.1.2: GHSA-6v7p-g79w-8964"}, "properties": {"repobilityId": "4805c7caf4a4f90d", "scanner": "scanner-primary", "fingerprint": "8f8b50c352db88e9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6v7p-g79w-8964"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a26de7966f56918e", "level": "warning", "message": {"text": "Vulnerable dependency msgpack 1.1.2: PYSEC-2026-3625"}, "properties": {"repobilityId": "44e40a41f74e3744", "scanner": "scanner-primary", "fingerprint": "a26de7966f56918e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3625"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fa4a873a19a6432", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-3gq4-3j92-5w49"}, "properties": {"repobilityId": "c596362d88b302c9", "scanner": "scanner-primary", "fingerprint": "9fa4a873a19a6432", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3gq4-3j92-5w49"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17acff953c797778", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-3gqm-fcw5-w839"}, "properties": {"repobilityId": "f3d8bd9e1b9f3699", "scanner": "scanner-primary", "fingerprint": "17acff953c797778", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3gqm-fcw5-w839"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7ad18a6b832432b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-469j-vmhf-r6v7"}, "properties": {"repobilityId": "c519a37a1ecfb66c", "scanner": "scanner-primary", "fingerprint": "b7ad18a6b832432b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-469j-vmhf-r6v7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17b49608c92006ef", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-568f-pv23-39p4"}, "properties": {"repobilityId": "f79d7518cb50fe41", "scanner": "scanner-primary", "fingerprint": "17b49608c92006ef", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-568f-pv23-39p4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e57d778816c25ffa", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-5wp5-5229-5g6q"}, "properties": {"repobilityId": "d768e015ff6d40b5", "scanner": "scanner-primary", "fingerprint": "e57d778816c25ffa", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5wp5-5229-5g6q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbd3b51265e05ec8", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-68j8-pq59-fqgm"}, "properties": {"repobilityId": "edfafb0d16c6ad09", "scanner": "scanner-primary", "fingerprint": "cbd3b51265e05ec8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-68j8-pq59-fqgm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-437ece22eaf4bb4a", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-6hm5-jgcp-p838"}, "properties": {"repobilityId": "d1354156eb966dcc", "scanner": "scanner-primary", "fingerprint": "437ece22eaf4bb4a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6hm5-jgcp-p838"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1948cb708a28445a", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-6hwm-xvph-95vm"}, "properties": {"repobilityId": "e4d898b9931cd773", "scanner": "scanner-primary", "fingerprint": "1948cb708a28445a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6hwm-xvph-95vm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b6d663c0f3f693e1", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-6ww7-3frv-cqxh"}, "properties": {"repobilityId": "23f42890720621fc", "scanner": "scanner-primary", "fingerprint": "b6d663c0f3f693e1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6ww7-3frv-cqxh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e3b53aeae94fdb4", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-72r2-7mfr-5xr9"}, "properties": {"repobilityId": "1cda93e2de35c0cc", "scanner": "scanner-primary", "fingerprint": "9e3b53aeae94fdb4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-72r2-7mfr-5xr9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd109961a561ef11", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-7p94-766c-hgjp"}, "properties": {"repobilityId": "1f4eb40669cfb44e", "scanner": "scanner-primary", "fingerprint": "dd109961a561ef11", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7p94-766c-hgjp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2de43a46229e77e", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-848c-c2cx-j7qx"}, "properties": {"repobilityId": "e73b29cd081bce23", "scanner": "scanner-primary", "fingerprint": "a2de43a46229e77e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-848c-c2cx-j7qx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5366e71652c926ca", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-8mgp-746c-j5xp"}, "properties": {"repobilityId": "bd371f553390cf02", "scanner": "scanner-primary", "fingerprint": "5366e71652c926ca", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8mgp-746c-j5xp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9281ec31845fdfe4", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-8mpw-7fpc-4gqj"}, "properties": {"repobilityId": "40be796909584841", "scanner": "scanner-primary", "fingerprint": "9281ec31845fdfe4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8mpw-7fpc-4gqj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f0388c3bd15de2b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-97qj-x29f-37w7"}, "properties": {"repobilityId": "3ac6880ab3315561", "scanner": "scanner-primary", "fingerprint": "3f0388c3bd15de2b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-97qj-x29f-37w7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e15bee2e8cf197f", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-cw6x-m8jw-qmrh"}, "properties": {"repobilityId": "e8b8042490ff1ea4", "scanner": "scanner-primary", "fingerprint": "3e15bee2e8cf197f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cw6x-m8jw-qmrh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efd362786684374c", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-f794-5jv7-7672"}, "properties": {"repobilityId": "d40c4e1da07e49c0", "scanner": "scanner-primary", "fingerprint": "efd362786684374c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f794-5jv7-7672"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86418590e6db2b2d", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-ff5c-cp5c-9wjf"}, "properties": {"repobilityId": "607e1bf9ee7cb040", "scanner": "scanner-primary", "fingerprint": "86418590e6db2b2d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ff5c-cp5c-9wjf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a81c79c7f507fa2", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-fg7f-2386-8897"}, "properties": {"repobilityId": "961f6eb4da3d38cb", "scanner": "scanner-primary", "fingerprint": "1a81c79c7f507fa2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fg7f-2386-8897"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9762dfd14563555d", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-gfwx-w7gr-fvh7"}, "properties": {"repobilityId": "f83c8ba2e463b270", "scanner": "scanner-primary", "fingerprint": "9762dfd14563555d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gfwx-w7gr-fvh7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42233918f00a0a27", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-h8wq-7xc4-p3qx"}, "properties": {"repobilityId": "f287ddd6f7d551a2", "scanner": "scanner-primary", "fingerprint": "42233918f00a0a27", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h8wq-7xc4-p3qx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd27b996eb1c5b43", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-jm6w-m3j8-898g"}, "properties": {"repobilityId": "d1c8741cf1e4833b", "scanner": "scanner-primary", "fingerprint": "cd27b996eb1c5b43", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jm6w-m3j8-898g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-139a13c0fdb9983d", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-m42h-3232-vpv3"}, "properties": {"repobilityId": "695bd287807c0dc2", "scanner": "scanner-primary", "fingerprint": "139a13c0fdb9983d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m42h-3232-vpv3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cba428b9e0c5af48", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-m4rf-3fr8-xwx3"}, "properties": {"repobilityId": "ff967709b307fcd9", "scanner": "scanner-primary", "fingerprint": "cba428b9e0c5af48", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m4rf-3fr8-xwx3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-180a5ea1096fb2aa", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-p3m8-78j2-g5p3"}, "properties": {"repobilityId": "d1036f43e7ada7ef", "scanner": "scanner-primary", "fingerprint": "180a5ea1096fb2aa", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p3m8-78j2-g5p3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a463c584218a4179", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-p4gq-832x-fm9v"}, "properties": {"repobilityId": "23e3c5b306fa1bfd", "scanner": "scanner-primary", "fingerprint": "a463c584218a4179", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p4gq-832x-fm9v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-546c34741c899a30", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-p4rw-rvv2-7xwr"}, "properties": {"repobilityId": "c2977bd2e20cb383", "scanner": "scanner-primary", "fingerprint": "546c34741c899a30", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p4rw-rvv2-7xwr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91cf1f4425892f8e", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-qvv7-cg9c-w4x3"}, "properties": {"repobilityId": "7eec23ad3c26ef71", "scanner": "scanner-primary", "fingerprint": "91cf1f4425892f8e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qvv7-cg9c-w4x3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a4c798db317d90f", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-qx2g-xrx7-vfh8"}, "properties": {"repobilityId": "dbffdce7904fe766", "scanner": "scanner-primary", "fingerprint": "4a4c798db317d90f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qx2g-xrx7-vfh8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8446d22a92242657", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-r6gq-whwq-mvg9"}, "properties": {"repobilityId": "f28f1f3379840a7a", "scanner": "scanner-primary", "fingerprint": "8446d22a92242657", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r6gq-whwq-mvg9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b95e5a48a96a3bba", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-rf74-v2fm-23pw"}, "properties": {"repobilityId": "18656909726a04ed", "scanner": "scanner-primary", "fingerprint": "b95e5a48a96a3bba", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rf74-v2fm-23pw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eedee12884049197", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-rhp5-r9x4-f5g2"}, "properties": {"repobilityId": "98635bdf93b42160", "scanner": "scanner-primary", "fingerprint": "eedee12884049197", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rhp5-r9x4-f5g2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d70d05524bb202d", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-rrv8-h7p8-rx55"}, "properties": {"repobilityId": "f46726f4b843dc50", "scanner": "scanner-primary", "fingerprint": "7d70d05524bb202d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rrv8-h7p8-rx55"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26210f5da3e429b2", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-vp2x-qp44-57v7"}, "properties": {"repobilityId": "8c578e6ab3b0dbc3", "scanner": "scanner-primary", "fingerprint": "26210f5da3e429b2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vp2x-qp44-57v7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3df6c38b6fa4d713", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-w3v8-gmh9-3wv7"}, "properties": {"repobilityId": "5c3abf73c16f5abf", "scanner": "scanner-primary", "fingerprint": "3df6c38b6fa4d713", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w3v8-gmh9-3wv7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0aeb6916bcc03c9f", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-ww6m-cw3f-q94g"}, "properties": {"repobilityId": "c7dca8dd6247e964", "scanner": "scanner-primary", "fingerprint": "0aeb6916bcc03c9f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ww6m-cw3f-q94g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-850fbae352c1ccd4", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-x5ph-mj9p-rfr8"}, "properties": {"repobilityId": "f67c281349a033a4", "scanner": "scanner-primary", "fingerprint": "850fbae352c1ccd4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-x5ph-mj9p-rfr8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7bf678a3be2c2aea", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-x99w-6fgc-pmfw"}, "properties": {"repobilityId": "b774e19eaec139cd", "scanner": "scanner-primary", "fingerprint": "7bf678a3be2c2aea", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-x99w-6fgc-pmfw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09679c85435d9dd3", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: GHSA-xh95-f55m-82fw"}, "properties": {"repobilityId": "4e3fe8dc3259da87", "scanner": "scanner-primary", "fingerprint": "09679c85435d9dd3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xh95-f55m-82fw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e55d01f046029e3", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2078"}, "properties": {"repobilityId": "94181176cb7d727a", "scanner": "scanner-primary", "fingerprint": "8e55d01f046029e3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2078"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8ad61ca47bf3e10", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2085"}, "properties": {"repobilityId": "a85767da6b42b309", "scanner": "scanner-primary", "fingerprint": "e8ad61ca47bf3e10", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2085"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e31e2a91069f2189", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2235"}, "properties": {"repobilityId": "64d4959742770de6", "scanner": "scanner-primary", "fingerprint": "e31e2a91069f2189", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2235"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffb0d786b80c7deb", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2236"}, "properties": {"repobilityId": "b7b13430298057af", "scanner": "scanner-primary", "fingerprint": "ffb0d786b80c7deb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2236"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-974aa01beb221a69", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-2237"}, "properties": {"repobilityId": "6310fedeb12f3b80", "scanner": "scanner-primary", "fingerprint": "974aa01beb221a69", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2237"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-225a3430a6d4e113", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3581"}, "properties": {"repobilityId": "3ab156129be7beaa", "scanner": "scanner-primary", "fingerprint": "225a3430a6d4e113", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3581"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f51f5264f6252a9", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3582"}, "properties": {"repobilityId": "b8006f5e944a9275", "scanner": "scanner-primary", "fingerprint": "6f51f5264f6252a9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3582"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c80d8142569a9ce", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3583"}, "properties": {"repobilityId": "ff64ef40b7026bf1", "scanner": "scanner-primary", "fingerprint": "9c80d8142569a9ce", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3583"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-582db587d773363d", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3584"}, "properties": {"repobilityId": "15cfdcaf86c374a7", "scanner": "scanner-primary", "fingerprint": "582db587d773363d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3584"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5f70d62a17e433b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3657"}, "properties": {"repobilityId": "a45b8420212591bb", "scanner": "scanner-primary", "fingerprint": "c5f70d62a17e433b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3657"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c86fc62b1e6963ac", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3722"}, "properties": {"repobilityId": "de266cd03f6e3cd3", "scanner": "scanner-primary", "fingerprint": "c86fc62b1e6963ac", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3722"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8e6a38b61e0ae2b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3723"}, "properties": {"repobilityId": "71ef6915e53f72b8", "scanner": "scanner-primary", "fingerprint": "a8e6a38b61e0ae2b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3723"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46f537cf91fdafc4", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3724"}, "properties": {"repobilityId": "d00c1f593f70033c", "scanner": "scanner-primary", "fingerprint": "46f537cf91fdafc4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3724"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a9e93c027858210", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3728"}, "properties": {"repobilityId": "cd1e366339b8ea97", "scanner": "scanner-primary", "fingerprint": "0a9e93c027858210", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3728"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e53e8da62be3954a", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3729"}, "properties": {"repobilityId": "d19745ffa2aca3bd", "scanner": "scanner-primary", "fingerprint": "e53e8da62be3954a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3729"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c164f092564ff436", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3730"}, "properties": {"repobilityId": "146e9a3fa81874f7", "scanner": "scanner-primary", "fingerprint": "c164f092564ff436", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3730"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-776e47750927adc9", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3731"}, "properties": {"repobilityId": "7f687510d98819d8", "scanner": "scanner-primary", "fingerprint": "776e47750927adc9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3731"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77fdc7b09d5c0bb4", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3732"}, "properties": {"repobilityId": "9014343c796262bd", "scanner": "scanner-primary", "fingerprint": "77fdc7b09d5c0bb4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3732"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-153d7f1b8310dd93", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3733"}, "properties": {"repobilityId": "d17d5ba5b5f4e069", "scanner": "scanner-primary", "fingerprint": "153d7f1b8310dd93", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3733"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c91f2513ec440cc7", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3734"}, "properties": {"repobilityId": "d81ef21047df1f38", "scanner": "scanner-primary", "fingerprint": "c91f2513ec440cc7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3734"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-236f12180171a9bb", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3735"}, "properties": {"repobilityId": "9c977d130f53aa59", "scanner": "scanner-primary", "fingerprint": "236f12180171a9bb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3735"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a30758488fb0d2b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3736"}, "properties": {"repobilityId": "32cf40cb75c083ce", "scanner": "scanner-primary", "fingerprint": "3a30758488fb0d2b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3736"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9662dfa2daeb0360", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3737"}, "properties": {"repobilityId": "b1ce931fdf6ac1be", "scanner": "scanner-primary", "fingerprint": "9662dfa2daeb0360", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3737"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b89ee2affb54f8c", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3738"}, "properties": {"repobilityId": "63648dbd77453a5c", "scanner": "scanner-primary", "fingerprint": "4b89ee2affb54f8c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3738"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eda4a1afec456d39", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3739"}, "properties": {"repobilityId": "06b0480e91567a41", "scanner": "scanner-primary", "fingerprint": "eda4a1afec456d39", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3739"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-211015087b4ad7a0", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3740"}, "properties": {"repobilityId": "6b42e803090cc6d5", "scanner": "scanner-primary", "fingerprint": "211015087b4ad7a0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3740"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea927deee6dc5d97", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3741"}, "properties": {"repobilityId": "83e76fdfdec9f56d", "scanner": "scanner-primary", "fingerprint": "ea927deee6dc5d97", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3741"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca7de73ee81f7693", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3748"}, "properties": {"repobilityId": "8b00cc7fb36c2ab7", "scanner": "scanner-primary", "fingerprint": "ca7de73ee81f7693", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3748"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d93e390bec40565", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3749"}, "properties": {"repobilityId": "9f1a47a0bf94add3", "scanner": "scanner-primary", "fingerprint": "0d93e390bec40565", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3749"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8bb368d3a7a05cf", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3750"}, "properties": {"repobilityId": "33f1a7562ae73ea2", "scanner": "scanner-primary", "fingerprint": "f8bb368d3a7a05cf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3750"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3accf65e17ce592", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3751"}, "properties": {"repobilityId": "8d33d8d13609d170", "scanner": "scanner-primary", "fingerprint": "b3accf65e17ce592", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3751"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e83a285c91df99d", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3752"}, "properties": {"repobilityId": "47c6e907b521bdde", "scanner": "scanner-primary", "fingerprint": "1e83a285c91df99d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3752"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f633d43dc1806402", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3868"}, "properties": {"repobilityId": "b5ac2a7b8377645c", "scanner": "scanner-primary", "fingerprint": "f633d43dc1806402", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3868"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23e4e9ab51f8a299", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3869"}, "properties": {"repobilityId": "afd9a33e347d96a8", "scanner": "scanner-primary", "fingerprint": "23e4e9ab51f8a299", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3869"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06e87b4ecab7e06b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3870"}, "properties": {"repobilityId": "85649487ce3f1d6f", "scanner": "scanner-primary", "fingerprint": "06e87b4ecab7e06b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3870"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6e313535765254b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3871"}, "properties": {"repobilityId": "1e84fd737557ad69", "scanner": "scanner-primary", "fingerprint": "f6e313535765254b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3871"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1a676614199c2b4", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3954"}, "properties": {"repobilityId": "e3637ec01cd8e2e0", "scanner": "scanner-primary", "fingerprint": "f1a676614199c2b4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3954"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aaee90635ccc84bd", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-3955"}, "properties": {"repobilityId": "38d4d2098d2a6a0f", "scanner": "scanner-primary", "fingerprint": "aaee90635ccc84bd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3955"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13c26e5efc84cff2", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-597"}, "properties": {"repobilityId": "8c3677a5fe0d6027", "scanner": "scanner-primary", "fingerprint": "13c26e5efc84cff2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-597"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-129336c776b9340a", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-96"}, "properties": {"repobilityId": "3caa56b996269e4d", "scanner": "scanner-primary", "fingerprint": "129336c776b9340a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-96"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3637616243caceda", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-97"}, "properties": {"repobilityId": "57881afba26c478d", "scanner": "scanner-primary", "fingerprint": "3637616243caceda", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-97"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d48a3d6ea354251", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-98"}, "properties": {"repobilityId": "0c9b3a65e0b9970a", "scanner": "scanner-primary", "fingerprint": "6d48a3d6ea354251", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-98"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd8414d2790d5b7b", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.2: PYSEC-2026-99"}, "properties": {"repobilityId": "b26d89a0df60ca74", "scanner": "scanner-primary", "fingerprint": "cd8414d2790d5b7b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fe415f94b885ef4", "level": "warning", "message": {"text": "Vulnerable dependency orjson 3.11.5: GHSA-hx9q-6w63-j58v"}, "properties": {"repobilityId": "259872a723c58df1", "scanner": "scanner-primary", "fingerprint": "6fe415f94b885ef4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hx9q-6w63-j58v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-742f1ecef50fbf55", "level": "warning", "message": {"text": "Vulnerable dependency pdfminer-six 20231228: GHSA-f83h-ghpp-7wcc"}, "properties": {"repobilityId": "53a720aa63c5d9d0", "scanner": "scanner-primary", "fingerprint": "742f1ecef50fbf55", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f83h-ghpp-7wcc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd93713bc727bb8f", "level": "warning", "message": {"text": "Vulnerable dependency pdfminer-six 20231228: GHSA-wf5f-4jwr-ppcp"}, "properties": {"repobilityId": "6e9e592f60f51943", "scanner": "scanner-primary", "fingerprint": "bd93713bc727bb8f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wf5f-4jwr-ppcp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ddd6f0aceeb95c9", "level": "warning", "message": {"text": "Vulnerable dependency pdfminer-six 20231228: PYSEC-2026-1761"}, "properties": {"repobilityId": "719a9f4a47c0bed3", "scanner": "scanner-primary", "fingerprint": "9ddd6f0aceeb95c9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1761"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb9b7bdcead367f8", "level": "warning", "message": {"text": "Vulnerable dependency pdfminer-six 20231228: PYSEC-2026-1762"}, "properties": {"repobilityId": "ec2ae9a13597cca2", "scanner": "scanner-primary", "fingerprint": "fb9b7bdcead367f8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1762"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37b0ae97549c6bc8", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-45hq-cxwh-f6vc"}, "properties": {"repobilityId": "be7612d8d8227103", "scanner": "scanner-primary", "fingerprint": "37b0ae97549c6bc8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-45hq-cxwh-f6vc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-265478397d78642b", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-4x4j-2g7c-83w6"}, "properties": {"repobilityId": "3eb3513132e9dc66", "scanner": "scanner-primary", "fingerprint": "265478397d78642b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4x4j-2g7c-83w6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26f92a070e4497da", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-5x94-69rx-g8h2"}, "properties": {"repobilityId": "03e516724d78c00c", "scanner": "scanner-primary", "fingerprint": "26f92a070e4497da", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5x94-69rx-g8h2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f13cd263147856f9", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-5xmw-vc9v-4wf2"}, "properties": {"repobilityId": "990c7bb618587c5e", "scanner": "scanner-primary", "fingerprint": "f13cd263147856f9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5xmw-vc9v-4wf2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1071d621bfe60b32", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-62p4-gmf7-7g93"}, "properties": {"repobilityId": "9e89f89146229487", "scanner": "scanner-primary", "fingerprint": "1071d621bfe60b32", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-62p4-gmf7-7g93"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a2337a4600bb977", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-6r8x-57c9-28j4"}, "properties": {"repobilityId": "712f9a01190bf502", "scanner": "scanner-primary", "fingerprint": "2a2337a4600bb977", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6r8x-57c9-28j4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e91d9765a0e72829", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-8v84-f9pq-wr9x"}, "properties": {"repobilityId": "fd8ff16a48471712", "scanner": "scanner-primary", "fingerprint": "e91d9765a0e72829", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8v84-f9pq-wr9x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7eb06035fcf7190f", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-9hw9-ch79-4vh6"}, "properties": {"repobilityId": "3c58108de5fea5e1", "scanner": "scanner-primary", "fingerprint": "7eb06035fcf7190f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9hw9-ch79-4vh6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8e00915ba70be64", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-cfh3-3jmp-rvhc"}, "properties": {"repobilityId": "5596577c7b64a564", "scanner": "scanner-primary", "fingerprint": "a8e00915ba70be64", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cfh3-3jmp-rvhc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-940e02ccfacbde0f", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-fj7v-r99m-22gq"}, "properties": {"repobilityId": "895e3827390999a8", "scanner": "scanner-primary", "fingerprint": "940e02ccfacbde0f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fj7v-r99m-22gq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98deeb6fd66195da", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-jjj6-mw9f-p565"}, "properties": {"repobilityId": "d540531170bceb9c", "scanner": "scanner-primary", "fingerprint": "98deeb6fd66195da", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jjj6-mw9f-p565"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0aa76375ef24e406", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-pg7v-jwj7-p798"}, "properties": {"repobilityId": "dc85009cc1dd650b", "scanner": "scanner-primary", "fingerprint": "0aa76375ef24e406", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pg7v-jwj7-p798"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6096b0b6ec35406", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-phj9-mv4w-65pm"}, "properties": {"repobilityId": "3f9d48188d4d04e0", "scanner": "scanner-primary", "fingerprint": "d6096b0b6ec35406", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-phj9-mv4w-65pm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76d02c738e01ef17", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-pwv6-vv43-88gr"}, "properties": {"repobilityId": "0e8d8822b976342e", "scanner": "scanner-primary", "fingerprint": "76d02c738e01ef17", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pwv6-vv43-88gr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4236b6f1601fe2c", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-r73j-pqj5-w3x7"}, "properties": {"repobilityId": "870e6255f68c5642", "scanner": "scanner-primary", "fingerprint": "a4236b6f1601fe2c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r73j-pqj5-w3x7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f90a1f0f42ecb33e", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-vjc4-5qp5-m44j"}, "properties": {"repobilityId": "f0321c5790690187", "scanner": "scanner-primary", "fingerprint": "f90a1f0f42ecb33e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vjc4-5qp5-m44j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d247991187bbcb38", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-whj4-6x5x-4v2j"}, "properties": {"repobilityId": "2ad288887617f4e6", "scanner": "scanner-primary", "fingerprint": "d247991187bbcb38", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-whj4-6x5x-4v2j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ef93e6e1403f00d", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-wjx4-4jcj-g98j"}, "properties": {"repobilityId": "27e4cfeefa550b76", "scanner": "scanner-primary", "fingerprint": "3ef93e6e1403f00d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wjx4-4jcj-g98j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fde71fd895b72049", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: GHSA-xj96-63gp-2gmr"}, "properties": {"repobilityId": "30b5222ad9ee7d9a", "scanner": "scanner-primary", "fingerprint": "fde71fd895b72049", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xj96-63gp-2gmr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bac000d01aa39c96", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-165"}, "properties": {"repobilityId": "2d61339003ba5bc1", "scanner": "scanner-primary", "fingerprint": "bac000d01aa39c96", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-165"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-daeb33b73de30caf", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2249"}, "properties": {"repobilityId": "98a384268a359fc0", "scanner": "scanner-primary", "fingerprint": "daeb33b73de30caf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2249"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae962457f2a882f0", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2250"}, "properties": {"repobilityId": "ace2623e949b8463", "scanner": "scanner-primary", "fingerprint": "ae962457f2a882f0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2250"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e43584b6f69de04", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2251"}, "properties": {"repobilityId": "c729099613966228", "scanner": "scanner-primary", "fingerprint": "7e43584b6f69de04", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2251"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d77689b64e532094", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2252"}, "properties": {"repobilityId": "540f05ebdb20f6ec", "scanner": "scanner-primary", "fingerprint": "d77689b64e532094", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2252"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-934670306f56f391", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2253"}, "properties": {"repobilityId": "57d1aa58518b8bef", "scanner": "scanner-primary", "fingerprint": "934670306f56f391", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2253"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c777ec64452201b6", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2254"}, "properties": {"repobilityId": "3ada91c83109dcba", "scanner": "scanner-primary", "fingerprint": "c777ec64452201b6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2254"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f25226e0d8915540", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2255"}, "properties": {"repobilityId": "cf2e2c4aa8fa39e9", "scanner": "scanner-primary", "fingerprint": "f25226e0d8915540", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2255"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c29efc9200f6bf06", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2256"}, "properties": {"repobilityId": "5269ab1522acfb86", "scanner": "scanner-primary", "fingerprint": "c29efc9200f6bf06", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2256"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-caf261bc9ffa82c2", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2257"}, "properties": {"repobilityId": "b7e0b36b2b911b6e", "scanner": "scanner-primary", "fingerprint": "caf261bc9ffa82c2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2257"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de1801db90c2aa89", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-2874"}, "properties": {"repobilityId": "1f249a88a38ea5b5", "scanner": "scanner-primary", "fingerprint": "de1801db90c2aa89", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2874"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d539a7fd862fc1f2", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3451"}, "properties": {"repobilityId": "ad89384b4adbd5d8", "scanner": "scanner-primary", "fingerprint": "d539a7fd862fc1f2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3451"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-314ead1f6b2cf7c1", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3452"}, "properties": {"repobilityId": "c40c6f79c147e6fa", "scanner": "scanner-primary", "fingerprint": "314ead1f6b2cf7c1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3452"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ad28faafdaaa035", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3453"}, "properties": {"repobilityId": "5419607705fad42e", "scanner": "scanner-primary", "fingerprint": "6ad28faafdaaa035", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3453"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d440b130170fca1f", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3454"}, "properties": {"repobilityId": "fdf67fef99318f12", "scanner": "scanner-primary", "fingerprint": "d440b130170fca1f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3454"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5034ee01c9f97bb3", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3493"}, "properties": {"repobilityId": "473f8c1d06baf8ad", "scanner": "scanner-primary", "fingerprint": "5034ee01c9f97bb3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3493"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fe4d553c39e516c", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3494"}, "properties": {"repobilityId": "131b8aa7e26697ff", "scanner": "scanner-primary", "fingerprint": "9fe4d553c39e516c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3494"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18f1a0841daec9f0", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3495"}, "properties": {"repobilityId": "80c22b373a0821c8", "scanner": "scanner-primary", "fingerprint": "18f1a0841daec9f0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3495"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4515a479f99e5263", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.1.0: PYSEC-2026-3496"}, "properties": {"repobilityId": "cc3ac190fc54935d", "scanner": "scanner-primary", "fingerprint": "4515a479f99e5263", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3496"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b747a28ad768f258", "level": "warning", "message": {"text": "Vulnerable dependency pyarrow 22.0.0: GHSA-rgxp-2hwp-jwgg"}, "properties": {"repobilityId": "9f0bb0fea2f125fd", "scanner": "scanner-primary", "fingerprint": "b747a28ad768f258", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rgxp-2hwp-jwgg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-092b9a907a8e04e8", "level": "warning", "message": {"text": "Vulnerable dependency pyarrow 22.0.0: PYSEC-2026-113"}, "properties": {"repobilityId": "4f9ce5d64fe60051", "scanner": "scanner-primary", "fingerprint": "092b9a907a8e04e8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-113"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-519e186c14d3d9b9", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-63vm-454h-vhhq"}, "properties": {"repobilityId": "9911703c1f6f9206", "scanner": "scanner-primary", "fingerprint": "519e186c14d3d9b9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-63vm-454h-vhhq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db1bc0be762f3721", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-8ppf-4f7h-5ppj"}, "properties": {"repobilityId": "873a8ac7359bf771", "scanner": "scanner-primary", "fingerprint": "db1bc0be762f3721", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8ppf-4f7h-5ppj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b051c1e8dd8fddd", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-hm4w-wwcw-mr6r"}, "properties": {"repobilityId": "6f8dc18ac8a6262e", "scanner": "scanner-primary", "fingerprint": "7b051c1e8dd8fddd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hm4w-wwcw-mr6r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba4964d20f392a02", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-jr27-m4p2-rc6r"}, "properties": {"repobilityId": "0af88eff8d72ff3b", "scanner": "scanner-primary", "fingerprint": "ba4964d20f392a02", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jr27-m4p2-rc6r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-770aa0c3aa68c683", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: GHSA-m4p7-r5rc-7g4j"}, "properties": {"repobilityId": "ef674d19c9aa8d93", "scanner": "scanner-primary", "fingerprint": "770aa0c3aa68c683", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m4p7-r5rc-7g4j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b66b288df5d6381", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-1810"}, "properties": {"repobilityId": "a6f92f2047ca4b05", "scanner": "scanner-primary", "fingerprint": "1b66b288df5d6381", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1810"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44b441ba7ab3f945", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-2263"}, "properties": {"repobilityId": "3e295e87c8f50918", "scanner": "scanner-primary", "fingerprint": "44b441ba7ab3f945", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2263"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-804d8ef266672bec", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3455"}, "properties": {"repobilityId": "9ae4837eca152517", "scanner": "scanner-primary", "fingerprint": "804d8ef266672bec", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3455"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1cddde09877ac5a0", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3456"}, "properties": {"repobilityId": "fc68b67ad6f707ca", "scanner": "scanner-primary", "fingerprint": "1cddde09877ac5a0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3456"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14fe923086251812", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.1: PYSEC-2026-3457"}, "properties": {"repobilityId": "a7e24f54feb6f519", "scanner": "scanner-primary", "fingerprint": "14fe923086251812", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3457"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74ed0096e07009e8", "level": "warning", "message": {"text": "Vulnerable dependency pydantic-settings 2.12.0: GHSA-4xgf-cpjx-pc3j"}, "properties": {"repobilityId": "3271eca0f8494383", "scanner": "scanner-primary", "fingerprint": "74ed0096e07009e8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4xgf-cpjx-pc3j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-398dcfc9295e08cd", "level": "warning", "message": {"text": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq"}, "properties": {"repobilityId": "b5634ffa34a95a85", "scanner": "scanner-primary", "fingerprint": "398dcfc9295e08cd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5239-wwwm-4pmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e1507733f542c28", "level": "warning", "message": {"text": "Vulnerable dependency pygments 2.19.2: PYSEC-2026-2987"}, "properties": {"repobilityId": "742bc0a156249eb7", "scanner": "scanner-primary", "fingerprint": "4e1507733f542c28", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2987"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bddf7db07cb19b05", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-752w-5fwx-jx9f"}, "properties": {"repobilityId": "9fe11538f0b6eb9d", "scanner": "scanner-primary", "fingerprint": "bddf7db07cb19b05", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-752w-5fwx-jx9f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3cb0b003eb924a6b", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-993g-76c3-p5m4"}, "properties": {"repobilityId": "4155fe1932230b4e", "scanner": "scanner-primary", "fingerprint": "3cb0b003eb924a6b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-993g-76c3-p5m4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68765d0971d6c2da", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-fhv5-28vv-h8m8"}, "properties": {"repobilityId": "132bf749403dfb53", "scanner": "scanner-primary", "fingerprint": "68765d0971d6c2da", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fhv5-28vv-h8m8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4fd05e167e3f798", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-jq35-7prp-9v3f"}, "properties": {"repobilityId": "a279e1a00ecaccd6", "scanner": "scanner-primary", "fingerprint": "f4fd05e167e3f798", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jq35-7prp-9v3f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2211e6971a1746a7", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-w7vc-732c-9m39"}, "properties": {"repobilityId": "143979644656d3d1", "scanner": "scanner-primary", "fingerprint": "2211e6971a1746a7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w7vc-732c-9m39"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1881b15d57696d97", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: GHSA-xgmm-8j9v-c9wx"}, "properties": {"repobilityId": "4cf53d5ca6105a1b", "scanner": "scanner-primary", "fingerprint": "1881b15d57696d97", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xgmm-8j9v-c9wx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67555c70542d21fa", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2025-183"}, "properties": {"repobilityId": "493d301f2178e601", "scanner": "scanner-primary", "fingerprint": "67555c70542d21fa", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2025-183"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-848c1cdf908518bb", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-120"}, "properties": {"repobilityId": "689b3293a4583dba", "scanner": "scanner-primary", "fingerprint": "848c1cdf908518bb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-120"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e41344da90e886b7", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-175"}, "properties": {"repobilityId": "4b42ef3e244564bf", "scanner": "scanner-primary", "fingerprint": "e41344da90e886b7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-175"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc510c6154bd92cb", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-176"}, "properties": {"repobilityId": "b290f7a379c2d2d9", "scanner": "scanner-primary", "fingerprint": "bc510c6154bd92cb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-176"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd194783a515326f", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-177"}, "properties": {"repobilityId": "192a7b3c08822149", "scanner": "scanner-primary", "fingerprint": "dd194783a515326f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-177"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-702cc25cd7238c90", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-178"}, "properties": {"repobilityId": "46c26ebbfe1b7e1b", "scanner": "scanner-primary", "fingerprint": "702cc25cd7238c90", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-178"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b76f48fb708a978", "level": "warning", "message": {"text": "Vulnerable dependency pyjwt 2.10.1: PYSEC-2026-179"}, "properties": {"repobilityId": "4ae9c38dc8050caa", "scanner": "scanner-primary", "fingerprint": "3b76f48fb708a978", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-179"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e493b4a30b129738", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-23w6-3w8w-8484"}, "properties": {"repobilityId": "f5196927318822fd", "scanner": "scanner-primary", "fingerprint": "e493b4a30b129738", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23w6-3w8w-8484"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7907c63bfbf1d9ad", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-248m-82v9-q6g6"}, "properties": {"repobilityId": "cff9d28d60a1ba35", "scanner": "scanner-primary", "fingerprint": "7907c63bfbf1d9ad", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-248m-82v9-q6g6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a9d2d3a1b0940d6a", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-2q4j-m29v-hq73"}, "properties": {"repobilityId": "8c9d10ef62023dd9", "scanner": "scanner-primary", "fingerprint": "a9d2d3a1b0940d6a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2q4j-m29v-hq73"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fba47c9307ddbf9d", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-2rw7-x74f-jg35"}, "properties": {"repobilityId": "640bf3550842063f", "scanner": "scanner-primary", "fingerprint": "fba47c9307ddbf9d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2rw7-x74f-jg35"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b3c19c1d668e047", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-3crg-w4f6-42mx"}, "properties": {"repobilityId": "63049f11639811c4", "scanner": "scanner-primary", "fingerprint": "1b3c19c1d668e047", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3crg-w4f6-42mx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1449b4a97bee7e7c", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-4pxv-j86v-mhcw"}, "properties": {"repobilityId": "c41beb5491035b2e", "scanner": "scanner-primary", "fingerprint": "1449b4a97bee7e7c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4pxv-j86v-mhcw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08b3f248ec42af50", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-52x6-gq3r-vpf4"}, "properties": {"repobilityId": "1cf9ba69863e8ac8", "scanner": "scanner-primary", "fingerprint": "08b3f248ec42af50", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-52x6-gq3r-vpf4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4dc2b43f3a1799b", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-55h5-xmcq-c37v"}, "properties": {"repobilityId": "db3fb77948ff506b", "scanner": "scanner-primary", "fingerprint": "b4dc2b43f3a1799b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-55h5-xmcq-c37v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f000e1319e213a7", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-5hgr-hg42-57jg"}, "properties": {"repobilityId": "857288370abf2125", "scanner": "scanner-primary", "fingerprint": "8f000e1319e213a7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5hgr-hg42-57jg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7749f5e79af8aa8a", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-5qjq-93h5-hrgp"}, "properties": {"repobilityId": "f625f4ce1376918a", "scanner": "scanner-primary", "fingerprint": "7749f5e79af8aa8a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5qjq-93h5-hrgp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18627cc3d9e9b7fc", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-5xf7-4p34-54qr"}, "properties": {"repobilityId": "47532a561c7fd89b", "scanner": "scanner-primary", "fingerprint": "18627cc3d9e9b7fc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5xf7-4p34-54qr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3153534a7a9fd4b", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-763m-79hh-57f2"}, "properties": {"repobilityId": "8c26c6f9b903877d", "scanner": "scanner-primary", "fingerprint": "f3153534a7a9fd4b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-763m-79hh-57f2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6eb77cf5b3b52aac", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-7gw9-cf7v-778f"}, "properties": {"repobilityId": "c0f2eb7965ecbc36", "scanner": "scanner-primary", "fingerprint": "6eb77cf5b3b52aac", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7gw9-cf7v-778f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17b7a444f4b4d9f9", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-87mj-5ggw-8qc3"}, "properties": {"repobilityId": "7434e2db5ac1dde1", "scanner": "scanner-primary", "fingerprint": "17b7a444f4b4d9f9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-87mj-5ggw-8qc3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a8056162e0b519d", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-996q-pr4m-cvgq"}, "properties": {"repobilityId": "fceb39a65ed01da9", "scanner": "scanner-primary", "fingerprint": "3a8056162e0b519d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-996q-pr4m-cvgq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-678c10b199cfc6f5", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-9m86-7pmv-2852"}, "properties": {"repobilityId": "785bc563e4a12bdf", "scanner": "scanner-primary", "fingerprint": "678c10b199cfc6f5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9m86-7pmv-2852"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5edb1663ba4663c4", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-9mvc-8737-8j8h"}, "properties": {"repobilityId": "ea31902023954ae2", "scanner": "scanner-primary", "fingerprint": "5edb1663ba4663c4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9mvc-8737-8j8h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c183d2ae2439934", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-cj93-chg6-vgv8"}, "properties": {"repobilityId": "7ce7322049fb2ac0", "scanner": "scanner-primary", "fingerprint": "2c183d2ae2439934", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cj93-chg6-vgv8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e29d8820f688b5f", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-f2v5-7jq9-h8cg"}, "properties": {"repobilityId": "43eb0122bef0cd17", "scanner": "scanner-primary", "fingerprint": "3e29d8820f688b5f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f2v5-7jq9-h8cg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-324bec1def78134c", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-fc8x-2rww-xw9m"}, "properties": {"repobilityId": "d55819baec679cc3", "scanner": "scanner-primary", "fingerprint": "324bec1def78134c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fc8x-2rww-xw9m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c28caacf02f3d230", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-fp3f-mc75-235c"}, "properties": {"repobilityId": "775c2f6fee9e7d7d", "scanner": "scanner-primary", "fingerprint": "c28caacf02f3d230", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fp3f-mc75-235c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-778e20eedadbbbcf", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-fwg2-594c-jp42"}, "properties": {"repobilityId": "d66f3bc5ca7bec0c", "scanner": "scanner-primary", "fingerprint": "778e20eedadbbbcf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fwg2-594c-jp42"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3d045435eaae354", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-g867-7843-wf8q"}, "properties": {"repobilityId": "d5ec15118ddb5bee", "scanner": "scanner-primary", "fingerprint": "b3d045435eaae354", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g867-7843-wf8q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e9353bbe9d5e445", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-g9xf-7f8q-9mcj"}, "properties": {"repobilityId": "5e8e0f0340c7251d", "scanner": "scanner-primary", "fingerprint": "6e9353bbe9d5e445", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g9xf-7f8q-9mcj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f470b26faaa83bf", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-hqmh-ppp3-xvm7"}, "properties": {"repobilityId": "91e5c6399c48ac20", "scanner": "scanner-primary", "fingerprint": "8f470b26faaa83bf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hqmh-ppp3-xvm7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0bd8aec670fe8b6", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-j543-4vmf-qm7v"}, "properties": {"repobilityId": "02fcda9e9034384d", "scanner": "scanner-primary", "fingerprint": "a0bd8aec670fe8b6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j543-4vmf-qm7v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a803f8630c4e20d", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-jj6c-8h6c-hppx"}, "properties": {"repobilityId": "486358ca6b3ed238", "scanner": "scanner-primary", "fingerprint": "5a803f8630c4e20d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jj6c-8h6c-hppx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97a63c284cb355d9", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-jm82-fx9c-mx94"}, "properties": {"repobilityId": "0e7c971df7d70187", "scanner": "scanner-primary", "fingerprint": "97a63c284cb355d9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jm82-fx9c-mx94"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bceb7763c6886f56", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-jp53-mhqp-8xcg"}, "properties": {"repobilityId": "d97ab98abf84d9c9", "scanner": "scanner-primary", "fingerprint": "bceb7763c6886f56", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jp53-mhqp-8xcg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90c7de9510c69ad7", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-m2v9-299j-rv96"}, "properties": {"repobilityId": "71010ccaf1caddcb", "scanner": "scanner-primary", "fingerprint": "90c7de9510c69ad7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m2v9-299j-rv96"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92795d700fb3e3c5", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-qpxp-75px-xjcp"}, "properties": {"repobilityId": "5040868ff04b1598", "scanner": "scanner-primary", "fingerprint": "92795d700fb3e3c5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qpxp-75px-xjcp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2217cf740dc70b84", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-wgvp-vg3v-2xq3"}, "properties": {"repobilityId": "3e446505e6eadc63", "scanner": "scanner-primary", "fingerprint": "2217cf740dc70b84", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wgvp-vg3v-2xq3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bca65c9c8b42c44a", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-wjqc-6w8f-h24c"}, "properties": {"repobilityId": "ff7a04afa9834bf2", "scanner": "scanner-primary", "fingerprint": "bca65c9c8b42c44a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wjqc-6w8f-h24c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b88331af23f5836", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-x284-j5p8-9c5p"}, "properties": {"repobilityId": "6bbf9edec8cb9dac", "scanner": "scanner-primary", "fingerprint": "1b88331af23f5836", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-x284-j5p8-9c5p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d86598df67364b9e", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: GHSA-x7hp-r3qg-r3cj"}, "properties": {"repobilityId": "3b4b893898855ad1", "scanner": "scanner-primary", "fingerprint": "d86598df67364b9e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-x7hp-r3qg-r3cj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58c1508eed9a49cb", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-1827"}, "properties": {"repobilityId": "b86770f1341cc61a", "scanner": "scanner-primary", "fingerprint": "58c1508eed9a49cb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1827"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54a12bd5316fc711", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3005"}, "properties": {"repobilityId": "17c2b14d465023d2", "scanner": "scanner-primary", "fingerprint": "54a12bd5316fc711", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3005"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb02e260560ee857", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3006"}, "properties": {"repobilityId": "034aed3a65a12d7e", "scanner": "scanner-primary", "fingerprint": "bb02e260560ee857", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3006"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8674b2de4695da7", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3007"}, "properties": {"repobilityId": "9956dbac47d42d0d", "scanner": "scanner-primary", "fingerprint": "b8674b2de4695da7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3007"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b88fa43d8eb8b8da", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3009"}, "properties": {"repobilityId": "cab1351ccbd77140", "scanner": "scanner-primary", "fingerprint": "b88fa43d8eb8b8da", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3009"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d21840873f5b1fa4", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3010"}, "properties": {"repobilityId": "bf27fb0e19697c87", "scanner": "scanner-primary", "fingerprint": "d21840873f5b1fa4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3010"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8350c9709815a6b2", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3011"}, "properties": {"repobilityId": "6318bcfc418a506a", "scanner": "scanner-primary", "fingerprint": "8350c9709815a6b2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3011"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f08c12c79168284", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3012"}, "properties": {"repobilityId": "5d0c819f4e62785a", "scanner": "scanner-primary", "fingerprint": "2f08c12c79168284", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3012"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16c70733110930b9", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3013"}, "properties": {"repobilityId": "4e2be024054b59d4", "scanner": "scanner-primary", "fingerprint": "16c70733110930b9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3013"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51e728690cea498e", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3014"}, "properties": {"repobilityId": "fefb1e5d5cb19e63", "scanner": "scanner-primary", "fingerprint": "51e728690cea498e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3014"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b688428ccccc9b9b", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3015"}, "properties": {"repobilityId": "d122d9d5e6722b41", "scanner": "scanner-primary", "fingerprint": "b688428ccccc9b9b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3015"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f77839506846dcc8", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3016"}, "properties": {"repobilityId": "6e26945f0e592c59", "scanner": "scanner-primary", "fingerprint": "f77839506846dcc8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3016"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9121641602222e60", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3017"}, "properties": {"repobilityId": "8cd9a85a5c26e817", "scanner": "scanner-primary", "fingerprint": "9121641602222e60", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3017"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b38edce702d00bb5", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3018"}, "properties": {"repobilityId": "535a1e8b863a62d9", "scanner": "scanner-primary", "fingerprint": "b38edce702d00bb5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3018"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c34483c2df6f1e9f", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3019"}, "properties": {"repobilityId": "304d6b0091ce621e", "scanner": "scanner-primary", "fingerprint": "c34483c2df6f1e9f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3019"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee8d3f59109a691d", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3020"}, "properties": {"repobilityId": "127952b0f0babdf9", "scanner": "scanner-primary", "fingerprint": "ee8d3f59109a691d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3020"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad18899682ab2616", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3021"}, "properties": {"repobilityId": "efb3a4d678f039a4", "scanner": "scanner-primary", "fingerprint": "ad18899682ab2616", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3021"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e7cf3d7b87a76d1", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3022"}, "properties": {"repobilityId": "0ef2bfec34a2e86a", "scanner": "scanner-primary", "fingerprint": "8e7cf3d7b87a76d1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3022"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41736884e7129214", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3023"}, "properties": {"repobilityId": "0b9748c6ad5647bf", "scanner": "scanner-primary", "fingerprint": "41736884e7129214", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3023"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-214c6578bd39c6cb", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3024"}, "properties": {"repobilityId": "470f92211b01e974", "scanner": "scanner-primary", "fingerprint": "214c6578bd39c6cb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3024"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8181b9901339ccbb", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3025"}, "properties": {"repobilityId": "57e2d25d04a03db1", "scanner": "scanner-primary", "fingerprint": "8181b9901339ccbb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3025"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14119680e614fcd8", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3026"}, "properties": {"repobilityId": "134dac7a71b96cd7", "scanner": "scanner-primary", "fingerprint": "14119680e614fcd8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3026"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c55301b168d0cdc5", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3027"}, "properties": {"repobilityId": "888b2d4859fe94b3", "scanner": "scanner-primary", "fingerprint": "c55301b168d0cdc5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3027"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-622218bc1b8e6d0f", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3610"}, "properties": {"repobilityId": "a7efec13d5660337", "scanner": "scanner-primary", "fingerprint": "622218bc1b8e6d0f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3610"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da14c8cbe8e5247a", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3611"}, "properties": {"repobilityId": "f8b0f7636acd4bdf", "scanner": "scanner-primary", "fingerprint": "da14c8cbe8e5247a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3611"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2269868896e16af0", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3612"}, "properties": {"repobilityId": "b821f8b3fa66eebc", "scanner": "scanner-primary", "fingerprint": "2269868896e16af0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3612"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5706c2fee825e4e5", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3613"}, "properties": {"repobilityId": "d8dc27d039d3d163", "scanner": "scanner-primary", "fingerprint": "5706c2fee825e4e5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3613"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73f828cf592b621f", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3655"}, "properties": {"repobilityId": "8a1a07a70a5cce8b", "scanner": "scanner-primary", "fingerprint": "73f828cf592b621f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3655"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebb31cf621a16967", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3656"}, "properties": {"repobilityId": "1e7950ab9de78419", "scanner": "scanner-primary", "fingerprint": "ebb31cf621a16967", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3656"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f386d3c67e970746", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3911"}, "properties": {"repobilityId": "537436f0a7ea7cf6", "scanner": "scanner-primary", "fingerprint": "f386d3c67e970746", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3911"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d225a392f2f6b1b", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3912"}, "properties": {"repobilityId": "87e673a83a144a76", "scanner": "scanner-primary", "fingerprint": "4d225a392f2f6b1b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3912"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e19c82fbb449a2b7", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.6.0: PYSEC-2026-3913"}, "properties": {"repobilityId": "10913991b1f43bed", "scanner": "scanner-primary", "fingerprint": "e19c82fbb449a2b7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3913"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3b7cca938d97d63", "level": "warning", "message": {"text": "Vulnerable dependency pytest 9.0.2: GHSA-6w46-j5rx-g56g"}, "properties": {"repobilityId": "e59570a2dafd56b3", "scanner": "scanner-primary", "fingerprint": "e3b7cca938d97d63", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6w46-j5rx-g56g", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c23c2018b3e51041", "level": "warning", "message": {"text": "Vulnerable dependency pytest 9.0.2: PYSEC-2026-1845"}, "properties": {"repobilityId": "e6b865b784c8cff3", "scanner": "scanner-primary", "fingerprint": "c23c2018b3e51041", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1845", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c345b21ba3d9772", "level": "warning", "message": {"text": "Vulnerable dependency python-dotenv 1.2.1: GHSA-mf9w-mj56-hr94"}, "properties": {"repobilityId": "c0b0f199ae9f3260", "scanner": "scanner-primary", "fingerprint": "8c345b21ba3d9772", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mf9w-mj56-hr94"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d65bbc995b802ee", "level": "warning", "message": {"text": "Vulnerable dependency python-dotenv 1.2.1: PYSEC-2026-2270"}, "properties": {"repobilityId": "13b6671508444c05", "scanner": "scanner-primary", "fingerprint": "6d65bbc995b802ee", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2270"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f69f9f51dc6d74b9", "level": "warning", "message": {"text": "Dependency @dagrejs/dagre is two or more major versions behind"}, "properties": {"repobilityId": "bc0ad054c5e90b5e", "scanner": "scanner-primary", "fingerprint": "f69f9f51dc6d74b9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60540be043ad9776", "level": "warning", "message": {"text": "Dependency @dnd-kit/sortable is two or more major versions behind"}, "properties": {"repobilityId": "b24de9cfb7a74699", "scanner": "scanner-primary", "fingerprint": "60540be043ad9776", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc5ee730904409ae", "level": "warning", "message": {"text": "Dependency @hookform/resolvers is two or more major versions behind"}, "properties": {"repobilityId": "da2b1e4251cc31ef", "scanner": "scanner-primary", "fingerprint": "dc5ee730904409ae", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af63346a6b85f845", "level": "warning", "message": {"text": "Dependency @iconify/react is two or more major versions behind"}, "properties": {"repobilityId": "71b1f41582e4226d", "scanner": "scanner-primary", "fingerprint": "af63346a6b85f845", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bacc56e5da05920", "level": "warning", "message": {"text": "Dependency @mui/lab is two or more major versions behind"}, "properties": {"repobilityId": "679cb36b70d44daf", "scanner": "scanner-primary", "fingerprint": "3bacc56e5da05920", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f58fa2fcf27df017", "level": "warning", "message": {"text": "Dependency @mui/material is two or more major versions behind"}, "properties": {"repobilityId": "2beaed885e3d5e59", "scanner": "scanner-primary", "fingerprint": "f58fa2fcf27df017", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e737109f9169271", "level": "warning", "message": {"text": "Dependency @mui/x-data-grid is two or more major versions behind"}, "properties": {"repobilityId": "d862b43cd4c934e5", "scanner": "scanner-primary", "fingerprint": "4e737109f9169271", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b020e9ef406fa09c", "level": "warning", "message": {"text": "Dependency @mui/x-date-pickers is two or more major versions behind"}, "properties": {"repobilityId": "eb8aac1ae386caad", "scanner": "scanner-primary", "fingerprint": "b020e9ef406fa09c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66596a73e24bd758", "level": "note", "message": {"text": "Dependency @sentry/react is a major version behind"}, "properties": {"repobilityId": "f34db5d315bfb984", "scanner": "scanner-primary", "fingerprint": "66596a73e24bd758", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0770c72f6bf70d02", "level": "warning", "message": {"text": "Dependency @sentry/vite-plugin is two or more major versions behind"}, "properties": {"repobilityId": "c8ad9a59d96dfd7e", "scanner": "scanner-primary", "fingerprint": "0770c72f6bf70d02", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86608f231884dc5f", "level": "note", "message": {"text": "Dependency @simplewebauthn/browser is a major version behind"}, "properties": {"repobilityId": "74e52a26a9994917", "scanner": "scanner-primary", "fingerprint": "86608f231884dc5f", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-923d98bfbfbf7d8d", "level": "warning", "message": {"text": "Dependency @stripe/stripe-js is two or more major versions behind"}, "properties": {"repobilityId": "18a43812b548ad85", "scanner": "scanner-primary", "fingerprint": "923d98bfbfbf7d8d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dd8277728338642", "level": "note", "message": {"text": "Dependency @tanstack/react-table is a major version behind"}, "properties": {"repobilityId": "b48048cb1b791c1f", "scanner": "scanner-primary", "fingerprint": "6dd8277728338642", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8c3929259cb295b", "level": "note", "message": {"text": "Dependency ag-grid-enterprise is a major version behind"}, "properties": {"repobilityId": "cf29116fb651503d", "scanner": "scanner-primary", "fingerprint": "d8c3929259cb295b", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a741c66c61271dfe", "level": "note", "message": {"text": "Dependency ag-grid-react is a major version behind"}, "properties": {"repobilityId": "e3977b5fdf11f140", "scanner": "scanner-primary", "fingerprint": "a741c66c61271dfe", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a168356e3de444a7", "level": "warning", "message": {"text": "Dependency apexcharts is two or more major versions behind"}, "properties": {"repobilityId": "a180f76b8b1d902b", "scanner": "scanner-primary", "fingerprint": "a168356e3de444a7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc06f382df232e46", "level": "warning", "message": {"text": "Dependency date-fns is two or more major versions behind"}, "properties": {"repobilityId": "49ace902e511cc4a", "scanner": "scanner-primary", "fingerprint": "fc06f382df232e46", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59f0eb187022855e", "level": "note", "message": {"text": "Dependency diff is a major version behind"}, "properties": {"repobilityId": "6e9e93df284a446b", "scanner": "scanner-primary", "fingerprint": "59f0eb187022855e", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2cbd711667fdd01", "level": "note", "message": {"text": "Dependency express is a major version behind"}, "properties": {"repobilityId": "79ff500406897352", "scanner": "scanner-primary", "fingerprint": "f2cbd711667fdd01", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "futureagi/ee/agenthub/eval_orchestrator/test_mcp_server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70bfff7672e6cba8", "level": "note", "message": {"text": "589 backend endpoints not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "70bfff7672e6cba8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}