Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

tirth8205/code-review-graph

https://github.com/tirth8205/code-review-graph · scanned 2026-07-23 19:39 UTC (4 days, 20 hours ago)

259 raw signals (0 security + 259 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 20 hours ago · v7 · 255 actionable findings from 1 signal source. 4 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
69.0
/100
Security checks
69
0 findings
System graph
69
90.0% cov · 255 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 47 Medium 150 Low 56 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 255 Crowd 0 Layer: Software 27 Security 79 Quality 24 Frontend 1 Cicd 1 Dependencies 123
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 69.0/100 with 90.0% coverage. It contains 3736 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 259 findings — concentrated in dependencies (123), security (79), software (27). Risk profile is high: 0 critical, 47 high, 150 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 253 of 255 actionable findings. 259 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 AWS-0011: CloudFront distribution does not have a WAF in front. — tests/fixtures/sample.tf
CloudFront distribution does not have a WAF in front. Distribution does not utilize a WAF. Rule: AWS-0011 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0013: CloudFront distribution uses outdated SSL/TLS protocols. — tests/fixtures/sample.tf
CloudFront distribution uses outdated SSL/TLS protocols. Distribution uses an insecure minimum TLS protocol version. Rule: AWS-0013 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0028: aws_instance should activate session tokens for Instance Metadata Service. — tests/fixtures/sample.tf
aws_instance should activate session tokens for Instance Metadata Service. Instance does not require IMDS access to require a token. Rule: AWS-0028 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0086: S3 Access block should block public ACL — tests/fixtures/sample.tf
S3 Access block should block public ACL No public access block so not blocking public acls Rule: AWS-0086 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0087: S3 Access block should block public policy — tests/fixtures/sample.tf
S3 Access block should block public policy No public access block so not blocking public policies Rule: AWS-0087 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0091: S3 Access Block should Ignore Public ACL — tests/fixtures/sample.tf
S3 Access Block should Ignore Public ACL No public access block so not blocking public acls Rule: AWS-0091 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0093: S3 Access block should restrict public bucket to limit access — tests/fixtures/sample.tf
S3 Access block should restrict public bucket to limit access No public access block so not restricting public buckets Rule: AWS-0093 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0131: Instance with unencrypted block device. — tests/fixtures/sample.tf
Instance with unencrypted block device. Root block device is not encrypted. Rule: AWS-0131 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 AWS-0132: S3 encryption should use Customer Managed Keys — tests/fixtures/sample.tf
S3 encryption should use Customer Managed Keys Bucket does not encrypt data with a customer managed key. Rule: AWS-0132 Severity: HIGH Target: tests/fixtures/sample.tf
Misconfig
high System graph security Trivy conf 1.00 CVE-2026-40192: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially c…
VulnCve 2026 40192
high System graph security Trivy conf 1.00 CVE-2026-42311: pillow 12.1.1 — uv.lock
Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.…
VulnCve 2026 42311
high System graph security Trivy conf 1.00 CVE-2026-42561: python-multipart 0.0.22 — uv.lock
python-multipart: python-multipart: Denial of Service via excessive multipart part headers Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, Multip…
VulnCve 2026 42561
high System graph security Trivy conf 1.00 CVE-2026-4372: transformers 4.57.6 — uv.lock
HuggingFace transformers vulnerable to remote code execution A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_impl…
VulnCve 2026 4372
high System graph security Trivy conf 1.00 CVE-2026-44431: urllib3 2.6.3 — uv.lock
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fals…
VulnCve 2026 44431
high System graph security Trivy conf 1.00 CVE-2026-44432: urllib3 2.6.3 — uv.lock
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the respo…
VulnCve 2026 44432
high System graph security Trivy conf 1.00 CVE-2026-48526: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in H…
VulnCve 2026 48526
high System graph security Trivy conf 1.00 CVE-2026-48818: starlette 0.52.1 — uv.lock
starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initia…
VulnCve 2026 48818
high System graph security Trivy conf 1.00 CVE-2026-5241: transformers 4.57.6 — uv.lock
python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initial…
VulnCve 2026 5241
high System graph security Trivy conf 1.00 CVE-2026-52869: mcp 1.26.0 — uv.lock
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTran…
VulnCve 2026 52869
high System graph security Trivy conf 1.00 CVE-2026-52870: mcp 1.26.0 — uv.lock
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() f…
VulnCve 2026 52870
high System graph security Trivy conf 1.00 CVE-2026-53539: python-multipart 0.0.22 — uv.lock
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it fir…
VulnCve 2026 53539
high System graph security Trivy conf 1.00 CVE-2026-54058: pillow 12.1.1 — uv.lock
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…
VulnCve 2026 54058
high System graph security Trivy conf 1.00 CVE-2026-54059: pillow 12.1.1 — uv.lock
python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…
VulnCve 2026 54059
high System graph security Trivy conf 1.00 CVE-2026-54060: pillow 12.1.1 — uv.lock
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…
VulnCve 2026 54060
high System graph security Trivy conf 1.00 CVE-2026-54283: starlette 0.52.1 — uv.lock
starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These …
VulnCve 2026 54283
high System graph security Trivy conf 1.00 CVE-2026-55379: pillow 12.1.1 — uv.lock
python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…
VulnCve 2026 55379
high System graph security Trivy conf 1.00 CVE-2026-55380: pillow 12.1.1 — uv.lock
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …
VulnCve 2026 55380
high System graph security Trivy conf 1.00 CVE-2026-59197: pillow 12.1.1 — uv.lock
Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…
VulnCve 2026 59197
high System graph security Trivy conf 1.00 CVE-2026-59199: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…
VulnCve 2026 59199
high System graph security Trivy conf 1.00 CVE-2026-59200: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…
VulnCve 2026 59200
high System graph security Trivy conf 1.00 CVE-2026-59204: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…
VulnCve 2026 59204
high System graph security Trivy conf 1.00 CVE-2026-59205: pillow 12.1.1 — uv.lock
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …
VulnCve 2026 59205
high System graph security Trivy conf 1.00 CVE-2026-59885: pyasn1 0.6.3 — uv.lock
pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted p…
VulnCve 2026 59885
high System graph security Trivy conf 1.00 CVE-2026-59886: pyasn1 0.6.3 — uv.lock
pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a f…
VulnCve 2026 59886
high System graph security Trivy conf 1.00 CVE-2026-59950: mcp 1.26.0 — uv.lock
MCP Python SDK: WebSocket server transport does not support Host/Origin validation The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes w…
VulnCve 2026 59950
high System graph security Trivy conf 1.00 GHSA-537c-gmf6-5ccf: cryptography 46.0.5 — uv.lock
Vulnerable OpenSSL included in cryptography wheels pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://o…
VulnGhsa 537c gmf6 5ccf
high System graph security security conf 1.00 Insecure pattern 'eval_used' in .github/workflows/eval.yml:56
Found a known-risky pattern (eval_used). Review and replace if possible.
.github/workflows/eval.yml:56 Eval used
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-ex…
code-review-graph-vscode/package-lock.json ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: GHSA-537c-gmf6-5ccf
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by GHSA-537c-gmf6-5ccf. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Vulnerable OpenSSL included in cryptography wheels Advisory: https://…
uv.lock ScaOsvGhsa 537c gmf6 5ccf
high System graph dependencies dependencies conf 0.90 Vulnerable dependency linkify-it 3.0.3: GHSA-22p9-wv53-3rq4
OSV.dev reports `linkify-it` at version `3.0.3` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-22p9-wv53-3rq4 (aka CVE-2026-48801). Note: `linkify-it` is a transitive dependency — pulled in by another package, not declared directly in a manifest. LinkifyIt#match sca…
code-review-graph-vscode/package-lock.json ScaOsvGhsa 22p9 wv53 3rq4
high System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-45hq-cxwh-f6vc
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow `BdfFontFile`: `Image.new()` called without `_decompre…
uv.lock ScaOsvGhsa 45hq cxwh f6vc
high System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-5x94-69rx-g8h2
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-5x94-69rx-g8h2 (aka CVE-2026-54060). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow: `FontFile.compile()`: `Image.new()` called without `_…
uv.lock ScaOsvGhsa 5x94 69rx g8h2
high System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-62p4-gmf7-7g93
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-62p4-gmf7-7g93 (aka CVE-2026-54058). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow: Out-of-bounds read via attacker-controlled row stride…
uv.lock ScaOsvGhsa 62p4 gmf7 7g93
high System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-5rvq-cxj2-64vf
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-5rvq-cxj2-64vf (aka CVE-2026-53539). Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. python-multipart: Quadratic-time querystr…
uv.lock ScaOsvGhsa 5rvq cxj2 64vf
high System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: GHSA-29pf-2h5f-8g72
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by GHSA-29pf-2h5f-8g72 (aka CVE-2026-4372). Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. HuggingFace transformers vulnerable to remote code…
uv.lock ScaOsvGhsa 29pf 2h5f 8g72
high System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-vmh5-mc38-953g
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-vmh5-mc38-953g (aka CVE-2026-9697). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to TLS ce…
code-review-graph-vscode/package-lock.json ScaOsvGhsa vmh5 mc38 953g
high System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-vxpw-j846-p89q
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-vxpw-j846-p89q (aka CVE-2026-12151). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici WebSocket client vu…
code-review-graph-vscode/package-lock.json ScaOsvGhsa vxpw j846 p89q
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .mcp.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.mcp.json VerificationMcp config
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/build-graph/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/build-graph/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/debug-issue/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/debug-issue/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/explore-codebase/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/explore-codebase/SKILL.md VerificationSkill file
medium System graph security Trivy conf 1.00 AWS-0010: Cloudfront distribution should have Access Logging configured — tests/fixtures/sample.tf
Cloudfront distribution should have Access Logging configured Distribution does not have logging enabled Rule: AWS-0010 Severity: MEDIUM Target: tests/fixtures/sample.tf
Misconfig
medium System graph security Trivy conf 1.00 AWS-0090: S3 Data should be versioned — tests/fixtures/sample.tf
S3 Data should be versioned Bucket does not have versioning enabled Rule: AWS-0090 Severity: MEDIUM Target: tests/fixtures/sample.tf
Misconfig
medium System graph security Trivy conf 1.00 AWS-0178: VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs. — tests/fixtures/sample.tf
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Reject…
Misconfig
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-71176: pytest 8.4.2 — uv.lock
pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges. Package: pytest In…
VulnCve 2025 71176
medium System graph security Trivy conf 1.00 CVE-2026-1839: transformers 4.57.6 — uv.lock
transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line …
VulnCve 2026 1839
medium System graph security Trivy conf 1.00 CVE-2026-25645: requests 2.32.5 — uv.lock
requests: Requests: Security bypass due to predictable temporary file creation Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. …
VulnCve 2026 25645
medium System graph security Trivy conf 1.00 CVE-2026-39892: cryptography 46.0.5 — uv.lock
cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.…
VulnCve 2026 39892
medium System graph security Trivy conf 1.00 CVE-2026-40347: python-multipart 0.0.22 — uv.lock
python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epi…
VulnCve 2026 40347
medium System graph security Trivy conf 1.00 CVE-2026-41425: authlib 1.6.9 — uv.lock
authlib: Authlib: Cross-Site Request Forgery (CSRF) vulnerability in OAuth cache feature Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability …
VulnCve 2026 41425
medium System graph security Trivy conf 1.00 CVE-2026-41479: authlib 1.6.9 — uv.lock
Authlib is a Python library which builds OAuth and OpenID Connect serv ... Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an uns…
VulnCve 2026 41479
medium System graph security Trivy conf 1.00 CVE-2026-42308: pillow 12.1.1 — uv.lock
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42309: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via specially crafted coordinate input Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw…
VulnCve 2026 42309
medium System graph security Trivy conf 1.00 CVE-2026-42310: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-44681: authlib 1.6.9 — uv.lock
Authlib is a Python library which builds OAuth and OpenID Connect serv ... Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a rem…
VulnCve 2026 44681
medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 3.11 — uv.lock
python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …
VulnCve 2026 45409
medium System graph security Trivy conf 1.00 CVE-2026-48522: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector regis…
VulnCve 2026 48522
medium System graph security Trivy conf 1.00 CVE-2026-48523: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The to…
VulnCve 2026 48523
medium System graph security Trivy conf 1.00 CVE-2026-48525: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the co…
VulnCve 2026 48525
medium System graph security Trivy conf 1.00 CVE-2026-48710: starlette 0.52.1 — uv.lock
starlette: Starlette: Security restriction bypass via malformed HTTP Host header Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the r…
VulnCve 2026 48710
medium System graph security Trivy conf 1.00 CVE-2026-48817: starlette 0.52.1 — uv.lock
starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up a…
VulnCve 2026 48817
medium System graph security Trivy conf 1.00 CVE-2026-55798: pillow 12.1.1 — uv.lock
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-59198: pillow 12.1.1 — uv.lock
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59203: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via crafted EPS file Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to t…
VulnCve 2026 59203
medium System graph security Trivy conf 1.00 CVE-2026-59890: setuptools 82.0.1 — uv.lock
setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursiv…
VulnCve 2026 59890
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — code_review_graph/embeddings.py:293
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
code_review_graph/embeddings.py:293 SecurityPython
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — scripts/diagnose_pypi_connectivity.py:54
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
scripts/diagnose_pypi_connectivity.py:54 SecurityPython
medium System graph security Trivy conf 1.00 GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.13.1 — uv.lock
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size ### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory e…
VulnGhsa 4xgf cpjx pc3j
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in code-review-graph-vscode/src/webview/graph.ts:670
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
code-review-graph-vscode/src/webview/graph.ts:670 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in code_review_graph/visualization.py:829
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
code_review_graph/visualization.py:829 Insert adjacent html
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/daemon.py:1058
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/daemon.py:1058 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/eval/benchmarks/impact_accuracy.py:35
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/eval/benchmarks/impact_accuracy.py:35 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/eval/benchmarks/token_efficiency.py:28
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/eval/benchmarks/token_efficiency.py:28 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/eval/runner.py:97
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/eval/runner.py:97 runtime safetyRobustness
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 34 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: GHSA-jj8c-mmj3-mmgv
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by GHSA-jj8c-mmj3-mmgv. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jj8c-mmj3…
uv.lock ScaOsvGhsa jj8c mmj3 mmgv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: GHSA-r95x-qfjj-fjj2
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by GHSA-r95x-qfjj-fjj2. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r95x-qfjj…
uv.lock ScaOsvGhsa r95x qfjj fjj2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: GHSA-w8p2-r796-3vmq
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by GHSA-w8p2-r796-3vmq. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w8p2-r796…
uv.lock ScaOsvGhsa w8p2 r796 3vmq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: PYSEC-2026-188
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by PYSEC-2026-188. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-188 Fix:…
uv.lock ScaOsvPysec 2026 188
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: PYSEC-2026-2119
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by PYSEC-2026-2119. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2119 Fi…
uv.lock ScaOsvPysec 2026 2119
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: PYSEC-2026-25
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by PYSEC-2026-25. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-25 Fix: u…
uv.lock ScaOsvPysec 2026 25
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-f886-m6hf-6m8v. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Ad…
code-review-graph-vscode/package-lock.json ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency click 8.3.1: PYSEC-2026-2132
OSV.dev reports `click` at version `8.3.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2132. Note: `click` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2132 Fix: u…
uv.lock ScaOsvPysec 2026 2132
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: GHSA-m959-cc7f-wv43
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by GHSA-m959-cc7f-wv43. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
uv.lock ScaOsvGhsa m959 cc7f wv43
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: GHSA-p423-j2cm-9vmq
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by GHSA-p423-j2cm-9vmq. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
uv.lock ScaOsvGhsa p423 j2cm 9vmq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: PYSEC-2026-35
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by PYSEC-2026-35. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-202…
uv.lock ScaOsvPysec 2026 35
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: PYSEC-2026-36
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by PYSEC-2026-36. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-202…
uv.lock ScaOsvPysec 2026 36
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.20.2: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.20.2` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-67mh-4wv8-2f99. esbuild enables any website to send any requests to the development server and read the response Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99…
code-review-graph-vscode/package.json ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency form-data 4.0.5: GHSA-hmw2-7cc7-3qxx
OSV.dev reports `form-data` at version `4.0.5` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx. Note: `form-data` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https…
code-review-graph-vscode/package-lock.json ScaOsvGhsa hmw2 7cc7 3qxx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency httplib2 0.31.2: PYSEC-2026-3444
OSV.dev reports `httplib2` at version `0.31.2` (resolved in `uv.lock`) is affected by PYSEC-2026-3444. Note: `httplib2` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3444…
uv.lock ScaOsvPysec 2026 3444
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx
OSV.dev reports `idna` at version `3.11` (resolved in `uv.lock`) is affected by GHSA-65pc-fj4g-8rjx (aka CVE-2026-45409). Note: `idna` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Internationalized Domain Names in Applications (IDNA): Specially cr…
uv.lock ScaOsvGhsa 65pc fj4g 8rjx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency linkify-it 3.0.3: GHSA-v245-v573-v5vm
OSV.dev reports `linkify-it` at version `3.0.3` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-v245-v573-v5vm. Note: `linkify-it` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: htt…
code-review-graph-vscode/package-lock.json ScaOsvGhsa v245 v573 v5vm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency markdown-it 12.3.2: GHSA-6v5v-wf23-fmfq
OSV.dev reports `markdown-it` at version `12.3.2` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-6v5v-wf23-fmfq. Note: `markdown-it` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: …
code-review-graph-vscode/package-lock.json ScaOsvGhsa 6v5v wf23 fmfq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: GHSA-hvrp-rf83-w775
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by GHSA-hvrp-rf83-w775. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hvrp-rf83-w775 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvGhsa hvrp rf83 w775
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: GHSA-jpw9-pfvf-9f58
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by GHSA-jpw9-pfvf-9f58. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvGhsa jpw9 pfvf 9f58
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: GHSA-vj7q-gjh5-988w
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by GHSA-vj7q-gjh5-988w. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vj7q-gjh5-988w Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvGhsa vj7q gjh5 988w
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: PYSEC-2026-3481
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3481. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3481 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 3481
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: PYSEC-2026-3482
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3482. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3482 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 3482
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: PYSEC-2026-3483
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3483. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3483 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 3483
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-4x4j-2g7c-83w6
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-4x4j-2g7c-83w6 (aka CVE-2026-55798). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow: WindowsViewer.get_command() OS command injection via …
uv.lock ScaOsvGhsa 4x4j 2g7c 83w6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-5xmw-vc9v-4wf2
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-5xmw-vc9v-4wf2 (aka CVE-2026-42309). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow has a heap buffer overflow with nested list coordinate…
uv.lock ScaOsvGhsa 5xmw vc9v 4wf2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-6r8x-57c9-28j4
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-6r8x-57c9-28j4. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6r8x-57c9-…
uv.lock ScaOsvGhsa 6r8x 57c9 28j4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-8v84-f9pq-wr9x
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-8v84-f9pq-wr9x. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8v84-f9pq-…
uv.lock ScaOsvGhsa 8v84 f9pq wr9x
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-9hw9-ch79-4vh6
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-9hw9-ch79-4vh6. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9hw9-ch79-…
uv.lock ScaOsvGhsa 9hw9 ch79 4vh6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-fj7v-r99m-22gq
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-fj7v-r99m-22gq. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fj7v-r99m-…
uv.lock ScaOsvGhsa fj7v r99m 22gq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-jjj6-mw9f-p565
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-jjj6-mw9f-p565. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jjj6-mw9f-…
uv.lock ScaOsvGhsa jjj6 mw9f p565
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-pg7v-jwj7-p798
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-pg7v-jwj7-p798. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pg7v-jwj7-…
uv.lock ScaOsvGhsa pg7v jwj7 p798
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-phj9-mv4w-65pm
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-phj9-mv4w-65pm. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-phj9-mv4w-…
uv.lock ScaOsvGhsa phj9 mv4w 65pm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-pwv6-vv43-88gr
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-pwv6-vv43-88gr. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pwv6-vv43-…
uv.lock ScaOsvGhsa pwv6 vv43 88gr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-r73j-pqj5-w3x7
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-r73j-pqj5-w3x7. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r73j-pqj5-…
uv.lock ScaOsvGhsa r73j pqj5 w3x7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-vjc4-5qp5-m44j
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-vjc4-5qp5-m44j. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vjc4-5qp5-…
uv.lock ScaOsvGhsa vjc4 5qp5 m44j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-whj4-6x5x-4v2j
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-whj4-6x5x-4v2j. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-whj4-6x5x-…
uv.lock ScaOsvGhsa whj4 6x5x 4v2j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-wjx4-4jcj-g98j
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-wjx4-4jcj-g98j. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wjx4-4jcj-…
uv.lock ScaOsvGhsa wjx4 4jcj g98j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-xj96-63gp-2gmr
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-xj96-63gp-2gmr. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xj96-63gp-…
uv.lock ScaOsvGhsa xj96 63gp 2gmr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-165
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-165. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-165 Fix: …
uv.lock ScaOsvPysec 2026 165
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2250
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2250. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2250 Fix…
uv.lock ScaOsvPysec 2026 2250
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2252
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2252. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2252 Fix…
uv.lock ScaOsvPysec 2026 2252
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2253
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2253. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2253 Fix…
uv.lock ScaOsvPysec 2026 2253
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2256
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2256. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2256 Fix…
uv.lock ScaOsvPysec 2026 2256
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2874
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2874. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2874 Fix…
uv.lock ScaOsvPysec 2026 2874
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3451
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3451. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3451 Fix…
uv.lock ScaOsvPysec 2026 3451
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3452
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3452. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3452 Fix…
uv.lock ScaOsvPysec 2026 3452
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3453
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3453. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3453 Fix…
uv.lock ScaOsvPysec 2026 3453
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3454
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3454. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3454 Fix…
uv.lock ScaOsvPysec 2026 3454
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3494
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3494. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3494 Fix…
uv.lock ScaOsvPysec 2026 3494
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3495
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3495. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3495 Fix…
uv.lock ScaOsvPysec 2026 3495
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3496
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3496. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3496 Fix…
uv.lock ScaOsvPysec 2026 3496
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: GHSA-8ppf-4f7h-5ppj
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by GHSA-8ppf-4f7h-5ppj. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8ppf-4f7h-5…
uv.lock ScaOsvGhsa 8ppf 4f7h 5ppj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: GHSA-hm4w-wwcw-mr6r
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by GHSA-hm4w-wwcw-mr6r. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hm4w-wwcw-m…
uv.lock ScaOsvGhsa hm4w wwcw mr6r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3455
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3455. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3455 Fix:…
uv.lock ScaOsvPysec 2026 3455
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3456
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3456. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3456 Fix:…
uv.lock ScaOsvPysec 2026 3456
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3457
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3457. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3457 Fix:…
uv.lock ScaOsvPysec 2026 3457
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pydantic-settings 2.13.1: GHSA-4xgf-cpjx-pc3j
OSV.dev reports `pydantic-settings` at version `2.13.1` (resolved in `uv.lock`) is affected by GHSA-4xgf-cpjx-pc3j (aka CVE-2026-58203). Note: `pydantic-settings` is a transitive dependency — pulled in by another package, not declared directly in a manifest. pydantic-settings: NestedSecretsSetting…
uv.lock ScaOsvGhsa 4xgf cpjx pc3j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq
OSV.dev reports `pygments` at version `2.19.2` (resolved in `uv.lock`) is affected by GHSA-5239-wwwm-4pmq (aka CVE-2026-4539). Note: `pygments` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pygments has Regular Expression Denial of Service (ReDoS) …
uv.lock ScaOsvGhsa 5239 wwwm 4pmq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-993g-76c3-p5m4
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-993g-76c3-p5m4. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-993g-76c3-p5…
uv.lock ScaOsvGhsa 993g 76c3 p5m4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-fhv5-28vv-h8m8
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-fhv5-28vv-h8m8. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fhv5-28vv-h8…
uv.lock ScaOsvGhsa fhv5 28vv h8m8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-jq35-7prp-9v3f
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-jq35-7prp-9v3f. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jq35-7prp-9v…
uv.lock ScaOsvGhsa jq35 7prp 9v3f
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-w7vc-732c-9m39
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-w7vc-732c-9m39. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w7vc-732c-9m…
uv.lock ScaOsvGhsa w7vc 732c 9m39
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-xgmm-8j9v-c9wx
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-xgmm-8j9v-c9wx. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xgmm-8j9v-c9…
uv.lock ScaOsvGhsa xgmm 8j9v c9wx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-175
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-175. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-175 Fix: up…
uv.lock ScaOsvPysec 2026 175
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-177
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-177. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-177 Fix: up…
uv.lock ScaOsvPysec 2026 177
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-178
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-178. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-178 Fix: up…
uv.lock ScaOsvPysec 2026 178
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-179
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-179. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-179 Fix: up…
uv.lock ScaOsvPysec 2026 179
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pytest 8.4.2: GHSA-6w46-j5rx-g56g
OSV.dev reports `pytest` at version `8.4.2` (resolved in `uv.lock`) is affected by GHSA-6w46-j5rx-g56g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6w46-j5rx-g56g Fix: upgrade `pytest` past the affected range per the advisory.
uv.lock ScaOsvGhsa 6w46 j5rx g56g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pytest 8.4.2: PYSEC-2026-1845
OSV.dev reports `pytest` at version `8.4.2` (resolved in `uv.lock`) is affected by PYSEC-2026-1845. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1845 Fix: upgrade `pytest` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 1845
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-6jv3-5f52-599m
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-6jv3-5f52-599m. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa 6jv3 5f52 599m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-mj87-hwqh-73pj
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-mj87-hwqh-73pj. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa mj87 hwqh 73pj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-pp6c-gr5w-3c5g
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-pp6c-gr5w-3c5g. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa pp6c gr5w 3c5g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-v9pg-7xvm-68hf
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-v9pg-7xvm-68hf. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa v9pg 7xvm 68hf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-vffw-93wf-4j4q
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-vffw-93wf-4j4q. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa vffw 93wf 4j4q
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3037
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3037. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3037
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3038
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3038. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3038
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3039
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3039. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3039
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3040
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3040. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3040
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3041
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3041. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3041
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency qs 6.15.0: GHSA-q8mj-m7cp-5q26
OSV.dev reports `qs` at version `6.15.0` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-q8mj-m7cp-5q26. Note: `qs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vu…
code-review-graph-vscode/package-lock.json ScaOsvGhsa q8mj m7cp 5q26
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency requests 2.32.5: GHSA-gc5v-m9x4-r6x2
OSV.dev reports `requests` at version `2.32.5` (resolved in `uv.lock`) is affected by GHSA-gc5v-m9x4-r6x2. Note: `requests` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gc5v-m…
uv.lock ScaOsvGhsa gc5v m9x4 r6x2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency requests 2.32.5: PYSEC-2026-2275
OSV.dev reports `requests` at version `2.32.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2275. Note: `requests` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2275…
uv.lock ScaOsvPysec 2026 2275
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency setuptools 82.0.1: GHSA-h35f-9h28-mq5c
OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by GHSA-h35f-9h28-mq5c. Note: `setuptools` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h3…
uv.lock ScaOsvGhsa h35f 9h28 mq5c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency setuptools 82.0.1: PYSEC-2026-3447
OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3447. Note: `setuptools` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-…
uv.lock ScaOsvPysec 2026 3447
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-82w8-qh3p-5jfq
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-82w8-qh3p-5jfq. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-82w8…
uv.lock ScaOsvGhsa 82w8 qh3p 5jfq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-86qp-5c8j-p5mr
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-86qp-5c8j-p5mr. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-86qp…
uv.lock ScaOsvGhsa 86qp 5c8j p5mr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-jp82-jpqv-5vv3
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-jp82-jpqv-5vv3. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jp82…
uv.lock ScaOsvGhsa jp82 jpqv 5vv3
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-wqp7-x3pw-xc5r
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-wqp7-x3pw-xc5r. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wqp7…
uv.lock ScaOsvGhsa wqp7 x3pw xc5r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-x746-7m8f-x49c
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-x746-7m8f-x49c. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x746…
uv.lock ScaOsvGhsa x746 7m8f x49c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-161
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-161. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-161…
uv.lock ScaOsvPysec 2026 161
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-2280
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2280. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-22…
uv.lock ScaOsvPysec 2026 2280
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-2281
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2281. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-22…
uv.lock ScaOsvPysec 2026 2281
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-248
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-248. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-248…
uv.lock ScaOsvPysec 2026 248
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-249
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-249. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-249…
uv.lock ScaOsvPysec 2026 249
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tmp 0.2.5: GHSA-ph9p-34f9-6g65
OSV.dev reports `tmp` at version `0.2.5` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-ph9p-34f9-6g65. Note: `tmp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
code-review-graph-vscode/package-lock.json ScaOsvGhsa ph9p 34f9 6g65
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency torch 2.10.0: GHSA-rrmf-rvhw-rf47
OSV.dev reports `torch` at version `2.10.0` (resolved in `uv.lock`) is affected by GHSA-rrmf-rvhw-rf47. Note: `torch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rrmf-rvhw-rf…
uv.lock ScaOsvGhsa rrmf rvhw rf47
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency torch 2.10.0: PYSEC-2026-139
OSV.dev reports `torch` at version `2.10.0` (resolved in `uv.lock`) is affected by PYSEC-2026-139. Note: `torch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-139 Fix: up…
uv.lock ScaOsvPysec 2026 139
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: GHSA-69w3-r845-3855
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by GHSA-69w3-r845-3855 (aka CVE-2026-1839). Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. HuggingFace Transformers allows for arbitrary code…
uv.lock ScaOsvGhsa 69w3 r845 3855
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: GHSA-fgcw-684q-jj6r
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by GHSA-fgcw-684q-jj6r. Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
uv.lock ScaOsvGhsa fgcw 684q jj6r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: PYSEC-2025-217
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by PYSEC-2025-217. Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-20…
uv.lock ScaOsvPysec 2025 217
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: PYSEC-2026-2290
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by PYSEC-2026-2290. Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2…
uv.lock ScaOsvPysec 2026 2290
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-hm92-r4w5-c3mj
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-hm92-r4w5-c3mj. Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://os…
code-review-graph-vscode/package-lock.json ScaOsvGhsa hm92 r4w5 c3mj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-p88m-4jfj-68fv
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-p88m-4jfj-68fv (aka CVE-2026-9679). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to HTTP h…
code-review-graph-vscode/package-lock.json ScaOsvGhsa p88m 4jfj 68fv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-pr7r-676h-xcf6
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-pr7r-676h-xcf6 (aka CVE-2026-9678). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to cross-…
code-review-graph-vscode/package-lock.json ScaOsvGhsa pr7r 676h xcf6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: GHSA-mf9v-mfxr-j63j
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by GHSA-mf9v-mfxr-j63j. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mf9v-mfxr…
uv.lock ScaOsvGhsa mf9v mfxr j63j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: GHSA-qccp-gfcp-xxvc
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by GHSA-qccp-gfcp-xxvc. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qccp-gfcp…
uv.lock ScaOsvGhsa qccp gfcp xxvc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: PYSEC-2026-141
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-141. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-141 Fix:…
uv.lock ScaOsvPysec 2026 141
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: PYSEC-2026-142
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-142. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-142 Fix:…
uv.lock ScaOsvPysec 2026 142
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency uuid 8.3.2: GHSA-w5hq-g745-h8pq
OSV.dev reports `uuid` at version `8.3.2` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-w5hq-g745-h8pq. Note: `uuid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev…
code-review-graph-vscode/package-lock.json ScaOsvGhsa w5hq g745 h8pq
low System graph security Trivy conf 1.00 AWS-0089: S3 Bucket Logging — tests/fixtures/sample.tf
S3 Bucket Logging Bucket has logging disabled Rule: AWS-0089 Severity: LOW Target: tests/fixtures/sample.tf
Misconfig
low System graph security Trivy conf 1.00 AWS-0094: S3 buckets should each define an aws_s3_bucket_public_access_block — tests/fixtures/sample.tf
S3 buckets should each define an aws_s3_bucket_public_access_block Bucket does not have a corresponding public access block. Rule: AWS-0094 Severity: LOW Target: tests/fixtures/sample.tf
Misconfig
low System graph security Trivy conf 1.00 AWS-0099: Missing description for security group. — tests/fixtures/sample.tf
Missing description for security group. Security group explicitly uses the default description. Rule: AWS-0099 Severity: LOW Target: tests/fixtures/sample.tf
Misconfig
low System graph security Trivy conf 1.00 CVE-2025-3000: torch 2.10.0 — uv.lock
A vulnerability classified as critical has been found in PyTorch 2.6.0 ... A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exp…
VulnCve 2025 3000
low System graph security Trivy conf 1.00 CVE-2026-34073: cryptography 46.0.5 — uv.lock
python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child cert…
VulnCve 2026 34073
low System graph security Trivy conf 1.00 CVE-2026-4539: pygments 2.19.2 — uv.lock
pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expr…
VulnCve 2026 4539
low System graph security Trivy conf 1.00 CVE-2026-48524: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid…
VulnCve 2026 48524
low System graph security Trivy conf 1.00 CVE-2026-53537: python-multipart 0.0.22 — uv.lock
multipart: Python-Multipart: Information disclosure via header parsing discrepancy Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 22…
VulnCve 2026 53537
low System graph security Trivy conf 1.00 CVE-2026-53538: python-multipart 0.0.22 — uv.lock
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. …
VulnCve 2026 53538
low System graph security Trivy conf 1.00 CVE-2026-53540: python-multipart 0.0.22 — uv.lock
python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request…
VulnCve 2026 53540
low System graph security Trivy conf 1.00 CVE-2026-54282: starlette 0.52.1 — uv.lock
starlette: Starlette: Information disclosure due to improper HTTP request path validation Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}…
VulnCve 2026 54282
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 165 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency better-sqlite3 is a major version behind
`better-sqlite3` is pinned at `12.4.1` in `code-review-graph-vscode/package.json` while the latest release on the npm registry is `13.0.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade…
code-review-graph-vscode/package.json FreshnessOutdated
low System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
5 files, 5 locations
.github/workflows/ci.yml:18
.github/workflows/eval.yml:24
.github/workflows/pr-review-comment.yml:56
.github/workflows/pr-review.yml:37
.github/workflows/publish.yml:18
CI/CD securitySupply chainGithub actions
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_migrate_v2` in code_review_graph/migrations.py:74
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: clear_memories
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/memory.py:121
low System graph software Dead code conf 1.00 Possibly dead Python function: d1
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:108
low System graph software Dead code conf 1.00 Possibly dead Python function: d2
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:199
low System graph software Dead code conf 1.00 Possibly dead Python function: d3
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:239
low System graph software Dead code conf 1.00 Possibly dead Python function: d4
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:334
low System graph software Dead code conf 1.00 Possibly dead Python function: d5
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:400
low System graph software Dead code conf 1.00 Possibly dead Python function: d6
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:451
low System graph software Dead code conf 1.00 Possibly dead Python function: d7
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:515
low System graph software Dead code conf 1.00 Possibly dead Python function: d8
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:586
low System graph software Dead code conf 1.00 Possibly dead Python function: d9
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
diagrams/generate_diagrams.py:661
low System graph software Dead code conf 1.00 Possibly dead Python function: enrich_jedi_calls
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/jedi_resolver.py:27
low System graph software Dead code conf 1.00 Possibly dead Python function: list_memories
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/memory.py:77
low System graph software Dead code conf 1.00 Possibly dead Python function: load_snapshot
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/graph_diff.py:56
low System graph software Dead code conf 1.00 Possibly dead Python function: replace_comment
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:2405
low System graph software Dead code conf 1.00 Possibly dead Python function: run_token_benchmark
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/token_benchmark.py:48
low System graph software Dead code conf 1.00 Possibly dead Python function: save_result
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/memory.py:14
low System graph software Dead code conf 1.00 Possibly dead Python function: save_snapshot
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/graph_diff.py:46
low System graph software Dead code conf 1.00 Possibly dead Python function: take_snapshot
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/graph_diff.py:15
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_AsyncFunctionDef
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:226
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_Call
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:208
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_ClassDef
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:232
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_FunctionDef
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:223
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_If
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:213
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_Import
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:112
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_ImportFrom
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:116
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_Lambda
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:109
low System graph software Dead code conf 1.00 Possibly dead Python function: visit_Name
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
code_review_graph/parser.py:93
low System graph quality Integrity conf 1.00 Stub function `add` (body is just `pass`/`return`) — code_review_graph/parser.py:5486
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `embed` (body is just `pass`/`return`) — code_review_graph/embeddings.py:48
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Complexity conf 1.00 Very large file: code_review_graph/cli.py (1783 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: code_review_graph/graph.py (1633 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: code_review_graph/parser.py (14182 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: code_review_graph/skills.py (1713 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: code_review_graph/visualization.py (2234 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_multilang.py (3669 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_parser.py (1518 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_skills.py (2189 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_tools.py (2092 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-35p6-xmwp-9g52
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-35p6-xmwp-9g52 (aka CVE-2026-6733). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to HTTP r…
code-review-graph-vscode/package-lock.json ScaOsvGhsa 35p6 xmwp 9g52
low System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-g8m3-5g58-fq7m
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-g8m3-5g58-fq7m (aka CVE-2026-11525). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to Set-C…
code-review-graph-vscode/package-lock.json ScaOsvGhsa g8m3 5g58 fq7m
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/1b294954-6950-44e6-b360-a37840e0669d/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/1b294954-6950-44e6-b360-a37840e0669d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.