{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-629d4e72dbabb85f", "name": "Docker base image is tag-pinned but not digest-pinned: rust:1-alpine3.23", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1-alpine3.23"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ea336501a13037e", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.24", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.24"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f0f9976570faa6d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68a2b8f5c8cd6b53", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3000e181cb8d1de6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe10465f3f10386d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2fc7b9381819720", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-676415be85434739", "name": "Very large file: pumpkin-codegen/src/configured_feature.rs (1709 lines)", "shortDescription": {"text": "Very large file: pumpkin-codegen/src/configured_feature.rs (1709 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fac2f00ad158de01", "name": "Very large file: pumpkin-codegen/src/noise_router.rs (1491 lines)", "shortDescription": {"text": "Very large file: pumpkin-codegen/src/noise_router.rs (1491 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca8820618ac39421", "name": "Very large file: pumpkin-codegen/src/item.rs (1683 lines)", "shortDescription": {"text": "Very large file: pumpkin-codegen/src/item.rs (1683 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48abdd16a73c844f", "name": "Very large file: pumpkin-codegen/src/block.rs (1558 lines)", "shortDescription": {"text": "Very large file: pumpkin-codegen/src/block.rs (1558 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c87be83a578c0d02", "name": "Very large file: pumpkin/src/plugin/loader/wasm/wasm_host/wit/v0_1/generated_packets.rs (2708 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/plugin/loader/wasm/wasm_host/wit/v0_1/generated_packets.rs (2708 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d31c43da693c2c8d", "name": "Very large file: pumpkin/src/plugin/loader/wasm/wasm_host/wit/v0_1/player.rs (2163 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/plugin/loader/wasm/wasm_host/wit/v0_1/player.rs (2163 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9a9570ed9eef7ca", "name": "Very large file: pumpkin/src/entity/living.rs (2957 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/entity/living.rs (2957 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99f639f133f739e6", "name": "Very large file: pumpkin/src/entity/mod.rs (3669 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/entity/mod.rs (3669 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0e46ade23e5bdd6", "name": "Very large file: pumpkin/src/entity/player.rs (5269 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/entity/player.rs (5269 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd6ed54a9e7e115c", "name": "Very large file: pumpkin/src/world/mod.rs (5458 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/world/mod.rs (5458 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e4fc42c3b6934b3", "name": "Very large file: pumpkin/src/net/bedrock/mod.rs (1416 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/net/bedrock/mod.rs (1416 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99e0bba1415bdeb7", "name": "Very large file: pumpkin/src/net/bedrock/play.rs (2211 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/net/bedrock/play.rs (2211 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-daef1e12cb640985", "name": "Very large file: pumpkin/src/net/java/play.rs (2922 lines)", "shortDescription": {"text": "Very large file: pumpkin/src/net/java/play.rs (2922 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b64d1d18dc8aeeb7", "name": "Very large file: pumpkin-world/src/chunk_system/schedule.rs (1435 lines)", "shortDescription": {"text": "Very large file: pumpkin-world/src/chunk_system/schedule.rs (1435 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfcff44411f92e07", "name": "Very large file: pumpkin-world/src/generation/proto_chunk.rs (1500 lines)", "shortDescription": {"text": "Very large file: pumpkin-world/src/generation/proto_chunk.rs (1500 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fb560c42b6cda8d", "name": "Very large file: pumpkin-world/src/generation/noise/aquifer_sampler.rs (2610 lines)", "shortDescription": {"text": "Very large file: pumpkin-world/src/generation/noise/aquifer_sampler.rs (2610 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57e624d2f33cfe14", "name": "Very large file: pumpkin-data/src/generated/noise_router.rs (9400 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/noise_router.rs (9400 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b73f7b2e6770ebed", "name": "Very large file: pumpkin-data/src/generated/sound.rs (9308 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/sound.rs (9308 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d176890fdb701ddc", "name": "Very large file: pumpkin-data/src/generated/tracked_data.rs (3987 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/tracked_data.rs (3987 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fffa1da0029895b9", "name": "Very large file: pumpkin-data/src/generated/item_id_remap.rs (1797 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/item_id_remap.rs (1797 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0207f897aa9d39f", "name": "Very large file: pumpkin-data/src/generated/entity_type.rs (11326 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/entity_type.rs (11326 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-839d1b3e5302b9eb", "name": "Very large file: pumpkin-data/src/generated/chest_loot.rs (5554 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/chest_loot.rs (5554 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0900c5104b679b1f", "name": "Very large file: pumpkin-data/src/generated/configured_features_generated.rs (4966 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/configured_features_generated.rs (4966 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efada62eefaddaaf", "name": "Very large file: pumpkin-data/src/generated/villager.rs (4679 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/villager.rs (4679 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be3d96e0c36df218", "name": "Very large file: pumpkin-data/src/generated/recipes.rs (21209 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/recipes.rs (21209 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-687849b5c3becfea", "name": "Very large file: pumpkin-data/src/generated/bedrock_creative.rs (10121 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/bedrock_creative.rs (10121 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0249c2f6a013691", "name": "Very large file: pumpkin-data/src/generated/packet.rs (3474 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/packet.rs (3474 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-385550a6f6457177", "name": "Very large file: pumpkin-data/src/generated/sound_id_remap.rs (1178 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/sound_id_remap.rs (1178 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f58a5b51b0f6f46e", "name": "Very large file: pumpkin-data/src/generated/placed_features_generated.rs (7741 lines)", "shortDescription": {"text": "Very large file: pumpkin-data/src/generated/placed_features_generated.rs (7741 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ff6a02fcc21c00b", "name": "Very large file: pumpkin-inventory/src/screen_handler.rs (1384 lines)", "shortDescription": {"text": "Very large file: pumpkin-inventory/src/screen_handler.rs (1384 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "9 test file(s) for 1680 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f751f46457b4f67", "name": "469 TODO/FIXME markers", "shortDescription": {"text": "469 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 127 placeholder/mock markers across 60 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2ca767f2c61e1a7", "name": "Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173", "shortDescription": {"text": "Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173"}, "fullDescription": {"text": "OSV.dev reports `proc-macro-error2` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0173.\n\nproc-macro-error2 is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0173\nFix: upgrade `proc-macro-error2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fb8901c582d0a66", "name": "Vulnerable dependency rsa 0.10.0-rc.18: RUSTSEC-2023-0071", "shortDescription": {"text": "Vulnerable dependency rsa 0.10.0-rc.18: RUSTSEC-2023-0071"}, "fullDescription": {"text": "OSV.dev reports `rsa` at version `0.10.0-rc.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2023-0071 (aka CVE-2023-49092).\n\nMarvin Attack: potential key recovery through timing sidechannels\n\nAliases: CVE-2023-49092, GHSA-4grx-2x9w-596c, GHSA-c38w-74pg-36hr\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2023-0071\nFix: upgrade `rsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55bee31f5923e1f7", "name": "Vulnerable dependency wasmtime-wasi 45.0.2: RUSTSEC-2026-0188", "shortDescription": {"text": "Vulnerable dependency wasmtime-wasi 45.0.2: RUSTSEC-2026-0188"}, "fullDescription": {"text": "OSV.dev reports `wasmtime-wasi` at version `45.0.2` (resolved in `pumpkin-protocol/fuzz/Cargo.lock`) is affected by RUSTSEC-2026-0188 (aka CVE-2026-58494).\n\nWASI hard links and renames bypass wasmtime-wasi's FilePerms for destination\n\nAliases: CVE-2026-58494, GHSA-4ch3-9j33-3pmj\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0188\nFix: upgrade `wasmtime-wasi` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e357551991f3ec4f", "name": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089", "shortDescription": {"text": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089"}, "fullDescription": {"text": "OSV.dev reports `atomic-polyfill` at version `1.0.3` (resolved in `Cargo.lock`) is affected by RUSTSEC-2023-0089.\nNote: `atomic-polyfill` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\natomic-polyfill is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2023-0089\nFix: upgrade `atomic-polyfill` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30752"}, "properties": {"repository": "Pumpkin-MC/Pumpkin", "repoUrl": "https://github.com/Pumpkin-MC/Pumpkin", "branch": "main"}, "results": [{"ruleId": "scanner-629d4e72dbabb85f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1-alpine3.23"}, "properties": {"repobilityId": "028ea5413ed312a7", "scanner": "scanner-primary", "fingerprint": "629d4e72dbabb85f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ea336501a13037e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.24"}, "properties": {"repobilityId": "f255bb1398c6b017", "scanner": "scanner-primary", "fingerprint": "8ea336501a13037e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "73176757530007c2", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-68a2b8f5c8cd6b53", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0036b33690fe05ae", "scanner": "scanner-primary", "fingerprint": "68a2b8f5c8cd6b53", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3000e181cb8d1de6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "59e7756e40cc0513", "scanner": "scanner-primary", "fingerprint": "3000e181cb8d1de6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rust.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-fe10465f3f10386d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "03d8b6ca4ff1e873", "scanner": "scanner-primary", "fingerprint": "fe10465f3f10386d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rust.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2fc7b9381819720", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ecf8d89fd92d4f5", "scanner": "scanner-primary", "fingerprint": "a2fc7b9381819720", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typos.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-676415be85434739", "level": "note", "message": {"text": "Very large file: pumpkin-codegen/src/configured_feature.rs (1709 lines)"}, "properties": {"repobilityId": "e30154c0f507f416", "scanner": "scanner-primary", "fingerprint": "676415be85434739", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fac2f00ad158de01", "level": "note", "message": {"text": "Very large file: pumpkin-codegen/src/noise_router.rs (1491 lines)"}, "properties": {"repobilityId": "631765034ff38d4d", "scanner": "scanner-primary", "fingerprint": "fac2f00ad158de01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ca8820618ac39421", "level": "note", "message": {"text": "Very large file: pumpkin-codegen/src/item.rs (1683 lines)"}, "properties": {"repobilityId": "c85ce43e9f5837ee", "scanner": "scanner-primary", "fingerprint": "ca8820618ac39421", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-48abdd16a73c844f", "level": "note", "message": {"text": "Very large file: pumpkin-codegen/src/block.rs (1558 lines)"}, "properties": {"repobilityId": "6f404223ddc6c2b0", "scanner": "scanner-primary", "fingerprint": "48abdd16a73c844f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c87be83a578c0d02", "level": "note", "message": {"text": "Very large file: pumpkin/src/plugin/loader/wasm/wasm_host/wit/v0_1/generated_packets.rs (2708 lines)"}, "properties": {"repobilityId": "cb1e84e4c86aaf2c", "scanner": "scanner-primary", "fingerprint": "c87be83a578c0d02", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d31c43da693c2c8d", "level": "note", "message": {"text": "Very large file: pumpkin/src/plugin/loader/wasm/wasm_host/wit/v0_1/player.rs (2163 lines)"}, "properties": {"repobilityId": "39296cddb46bc4f0", "scanner": "scanner-primary", "fingerprint": "d31c43da693c2c8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b9a9570ed9eef7ca", "level": "note", "message": {"text": "Very large file: pumpkin/src/entity/living.rs (2957 lines)"}, "properties": {"repobilityId": "a5b4aba36e143c8a", "scanner": "scanner-primary", "fingerprint": "b9a9570ed9eef7ca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-99f639f133f739e6", "level": "note", "message": {"text": "Very large file: pumpkin/src/entity/mod.rs (3669 lines)"}, "properties": {"repobilityId": "9e07cd541d741714", "scanner": "scanner-primary", "fingerprint": "99f639f133f739e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e0e46ade23e5bdd6", "level": "note", "message": {"text": "Very large file: pumpkin/src/entity/player.rs (5269 lines)"}, "properties": {"repobilityId": "f29f1afba7c83580", "scanner": "scanner-primary", "fingerprint": "e0e46ade23e5bdd6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bd6ed54a9e7e115c", "level": "note", "message": {"text": "Very large file: pumpkin/src/world/mod.rs (5458 lines)"}, "properties": {"repobilityId": "d2910c1fce3c7b65", "scanner": "scanner-primary", "fingerprint": "bd6ed54a9e7e115c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1e4fc42c3b6934b3", "level": "note", "message": {"text": "Very large file: pumpkin/src/net/bedrock/mod.rs (1416 lines)"}, "properties": {"repobilityId": "9c5cbe5f497e2cf4", "scanner": "scanner-primary", "fingerprint": "1e4fc42c3b6934b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-99e0bba1415bdeb7", "level": "note", "message": {"text": "Very large file: pumpkin/src/net/bedrock/play.rs (2211 lines)"}, "properties": {"repobilityId": "7f8c0b66c41db56c", "scanner": "scanner-primary", "fingerprint": "99e0bba1415bdeb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-daef1e12cb640985", "level": "note", "message": {"text": "Very large file: pumpkin/src/net/java/play.rs (2922 lines)"}, "properties": {"repobilityId": "0c260ac5d0759346", "scanner": "scanner-primary", "fingerprint": "daef1e12cb640985", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b64d1d18dc8aeeb7", "level": "note", "message": {"text": "Very large file: pumpkin-world/src/chunk_system/schedule.rs (1435 lines)"}, "properties": {"repobilityId": "42b2b1dfef1f9fd8", "scanner": "scanner-primary", "fingerprint": "b64d1d18dc8aeeb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bfcff44411f92e07", "level": "note", "message": {"text": "Very large file: pumpkin-world/src/generation/proto_chunk.rs (1500 lines)"}, "properties": {"repobilityId": "073fc925a35149fc", "scanner": "scanner-primary", "fingerprint": "bfcff44411f92e07", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0fb560c42b6cda8d", "level": "note", "message": {"text": "Very large file: pumpkin-world/src/generation/noise/aquifer_sampler.rs (2610 lines)"}, "properties": {"repobilityId": "5bed53fa6053126e", "scanner": "scanner-primary", "fingerprint": "0fb560c42b6cda8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57e624d2f33cfe14", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/noise_router.rs (9400 lines)"}, "properties": {"repobilityId": "6faaa562a1c19975", "scanner": "scanner-primary", "fingerprint": "57e624d2f33cfe14", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b73f7b2e6770ebed", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/sound.rs (9308 lines)"}, "properties": {"repobilityId": "9811c88165ab38c8", "scanner": "scanner-primary", "fingerprint": "b73f7b2e6770ebed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d176890fdb701ddc", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/tracked_data.rs (3987 lines)"}, "properties": {"repobilityId": "b0c668c873faa6c1", "scanner": "scanner-primary", "fingerprint": "d176890fdb701ddc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fffa1da0029895b9", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/item_id_remap.rs (1797 lines)"}, "properties": {"repobilityId": "acc91294314ba0df", "scanner": "scanner-primary", "fingerprint": "fffa1da0029895b9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d0207f897aa9d39f", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/entity_type.rs (11326 lines)"}, "properties": {"repobilityId": "c7dc3b0b3881e7e2", "scanner": "scanner-primary", "fingerprint": "d0207f897aa9d39f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-839d1b3e5302b9eb", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/chest_loot.rs (5554 lines)"}, "properties": {"repobilityId": "585c8b4b3121c972", "scanner": "scanner-primary", "fingerprint": "839d1b3e5302b9eb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0900c5104b679b1f", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/configured_features_generated.rs (4966 lines)"}, "properties": {"repobilityId": "a2e927190ee5d641", "scanner": "scanner-primary", "fingerprint": "0900c5104b679b1f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-efada62eefaddaaf", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/villager.rs (4679 lines)"}, "properties": {"repobilityId": "d40cdfec6e87ec15", "scanner": "scanner-primary", "fingerprint": "efada62eefaddaaf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-be3d96e0c36df218", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/recipes.rs (21209 lines)"}, "properties": {"repobilityId": "9332b44d0af00a18", "scanner": "scanner-primary", "fingerprint": "be3d96e0c36df218", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-687849b5c3becfea", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/bedrock_creative.rs (10121 lines)"}, "properties": {"repobilityId": "82cfb1418412a79b", "scanner": "scanner-primary", "fingerprint": "687849b5c3becfea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e0249c2f6a013691", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/packet.rs (3474 lines)"}, "properties": {"repobilityId": "cf4372c189d869f0", "scanner": "scanner-primary", "fingerprint": "e0249c2f6a013691", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-385550a6f6457177", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/sound_id_remap.rs (1178 lines)"}, "properties": {"repobilityId": "c28403c97b503b8b", "scanner": "scanner-primary", "fingerprint": "385550a6f6457177", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f58a5b51b0f6f46e", "level": "note", "message": {"text": "Very large file: pumpkin-data/src/generated/placed_features_generated.rs (7741 lines)"}, "properties": {"repobilityId": "2e99ca1b4652e13e", "scanner": "scanner-primary", "fingerprint": "f58a5b51b0f6f46e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1ff6a02fcc21c00b", "level": "note", "message": {"text": "Very large file: pumpkin-inventory/src/screen_handler.rs (1384 lines)"}, "properties": {"repobilityId": "b3ff9eca4ec5cf69", "scanner": "scanner-primary", "fingerprint": "1ff6a02fcc21c00b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-8f751f46457b4f67", "level": "note", "message": {"text": "469 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "8f751f46457b4f67", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "0829130fb5eca9fc", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "55f7a871f812eaf0", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-d2ca767f2c61e1a7", "level": "warning", "message": {"text": "Vulnerable dependency proc-macro-error2 2.0.1: RUSTSEC-2026-0173"}, "properties": {"repobilityId": "d7ad8c219cae993b", "scanner": "scanner-primary", "fingerprint": "d2ca767f2c61e1a7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0173"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fb8901c582d0a66", "level": "warning", "message": {"text": "Vulnerable dependency rsa 0.10.0-rc.18: RUSTSEC-2023-0071"}, "properties": {"repobilityId": "f3276bfedf3c2377", "scanner": "scanner-primary", "fingerprint": "9fb8901c582d0a66", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2023-0071"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55bee31f5923e1f7", "level": "warning", "message": {"text": "Vulnerable dependency wasmtime-wasi 45.0.2: RUSTSEC-2026-0188"}, "properties": {"repobilityId": "a710cf169ed72bdc", "scanner": "scanner-primary", "fingerprint": "55bee31f5923e1f7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0188"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pumpkin-protocol/fuzz/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e357551991f3ec4f", "level": "warning", "message": {"text": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089"}, "properties": {"repobilityId": "bcf8e56c221891d2", "scanner": "scanner-primary", "fingerprint": "e357551991f3ec4f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2023-0089", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}]}]}