{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "GHSA-65pc-fj4g-8rjx", "name": "idna: GHSA-65pc-fj4g-8rjx", "shortDescription": {"text": "idna: GHSA-65pc-fj4g-8rjx"}, "fullDescription": {"text": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR003", "name": "Compose service `renderer` image uses the latest tag", "shortDescription": {"text": "Compose service `renderer` image uses the latest tag"}, "fullDescription": {"text": "The latest tag is mutable and can change without a code review, producing different images from the same source."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.94, "cwe": "", "owasp": ""}}, {"id": "DKC013", "name": "Database service has no persistent data volume", "shortDescription": {"text": "Database service has no persistent data volume"}, "fullDescription": {"text": "Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "DKR002", "name": "Compose service `redis-exporter` image has no explicit tag", "shortDescription": {"text": "Compose service `redis-exporter` image has no explicit tag"}, "fullDescription": {"text": "Images without explicit tags resolve to a mutable default tag, which weakens reproducibility and review."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Docker images run as root unless the image or Dockerfile switches to a non-root user."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR018", "name": "Database dump or local database file is included in Docker build context", "shortDescription": {"text": "Database dump or local database file is included in Docker build context"}, "fullDescription": {"text": "Database exports and local database files can contain production data, credentials, or large binary payloads that slow Docker builds and can be copied into images by broad COPY instructions."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC134", "name": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left ", "shortDescription": {"text": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets"}, "fullDescription": {"text": "Move dummy values to fixtures / seed files. In application code, require these to come from config or fail closed. Add a CI grep that rejects 'lorem ipsum' and 'example.com' outside test files."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "ERR001", "name": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG ", "shortDescription": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "fullDescription": {"text": "Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC015", "name": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.", "shortDescription": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "fullDescription": {"text": "Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-PY", "name": "Python package `pytest-asyncio` is 1 major version(s) behind (0.20.1 -> 1.4.0)", "shortDescription": {"text": "Python package `pytest-asyncio` is 1 major version(s) behind (0.20.1 -> 1.4.0)"}, "fullDescription": {"text": "`pytest-asyncio==0.20.1` is 1 major version(s) behind the latest stable release on PyPI (1.4.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "Action `codecov/codecov-action` pinned to mutable ref `@v7`", "shortDescription": {"text": "Action `codecov/codecov-action` pinned to mutable ref `@v7`"}, "fullDescription": {"text": "`uses: codecov/codecov-action@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED124", "name": "requirements.txt: `numpy` has no version pin", "shortDescription": {"text": "requirements.txt: `numpy` has no version pin"}, "fullDescription": {"text": "Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED111", "name": "Bare except continues silently", "shortDescription": {"text": "Bare except continues silently"}, "fullDescription": {"text": "Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED109", "name": "Mutable default argument in `__init__` (list)", "shortDescription": {"text": "Mutable default argument in `__init__` (list)"}, "fullDescription": {"text": "`def __init__(... = []/{}/set())` \u2014 Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "GHSA-5239-wwwm-4pmq", "name": "pygments: GHSA-5239-wwwm-4pmq", "shortDescription": {"text": "pygments: GHSA-5239-wwwm-4pmq"}, "fullDescription": {"text": "Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC010", "name": "Compose service lacks no-new-privileges hardening", "shortDescription": {"text": "Compose service lacks no-new-privileges hardening"}, "fullDescription": {"text": "no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "DKC006", "name": "Compose service does not declare a runtime user", "shortDescription": {"text": "Compose service does not declare a runtime user"}, "fullDescription": {"text": "If the image does not define USER internally, this service may run as root."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.56, "cwe": "", "owasp": ""}}, {"id": "DKC015", "name": "Database service has no healthcheck", "shortDescription": {"text": "Database service has no healthcheck"}, "fullDescription": {"text": "Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "DKR008", "name": ".dockerignore misses sensitive defaults", "shortDescription": {"text": ".dockerignore misses sensitive defaults"}, "fullDescription": {"text": ".dockerignore exists but does not cover common secret or VCS patterns."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "SEC124", "name": "[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacke", "shortDescription": {"text": "[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason."}, "fullDescription": {"text": "Use `os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)` for atomic create-only. Use `tempfile.NamedTemporaryFile()` (not `mktemp`). For locking, use `fcntl.flock`."}, "properties": {"scanner": "repobility-threat-engine", "category": "race_condition", "severity": "low", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `encode_resp` has cognitive complexity 9 (SonarSource scale). Cognitive co", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `encode_resp` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion al"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 9."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "low", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "MINED116", "name": "Workflow references `secrets.AZURE_STORAGE_CONNECTION_STRING` in a `pull_request` workflow", "shortDescription": {"text": "Workflow references `secrets.AZURE_STORAGE_CONNECTION_STRING` in a `pull_request` workflow"}, "fullDescription": {"text": "`pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.AZURE_STORAGE_CONNECTION_STRING }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "low", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "AIC009", "name": "Multiple AI-agent scaffold marker files are present", "shortDescription": {"text": "Multiple AI-agent scaffold marker files are present"}, "fullDescription": {"text": "Repositories with several agent instruction, progress, or completion marker files are often generated scaffolds. They are not automatically wrong, but they deserve a reachability and ownership review before users treat the code as production-ready."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "MINED071", "name": "[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases.", "shortDescription": {"text": "[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED060", "name": "[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.", "shortDescription": {"text": "[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-401 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED067", "name": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.", "shortDescription": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-400 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal (and 1 more): Same pattern found in 1 additional files. Review if neede", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED053", "name": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeh", "shortDescription": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1392,CWE-798 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED075", "name": "[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL.", "shortDescription": {"text": "[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-690 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED042", "name": "[MINED042] Cpp New Without Delete (and 5 more): Same pattern found in 5 additional files. Review if needed.", "shortDescription": {"text": "[MINED042] Cpp New Without Delete (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-401 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 1 more): Same pattern found in 1 addit", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED022", "name": "[MINED022] C Strcpy (and 38 more): Same pattern found in 38 additional files. Review if needed.", "shortDescription": {"text": "[MINED022] C Strcpy (and 38 more): Same pattern found in 38 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-120 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED080", "name": "[MINED080] Cpp Using Namespace Std (and 89 more): Same pattern found in 89 additional files. Review if needed.", "shortDescription": {"text": "[MINED080] Cpp Using Namespace Std (and 89 more): Same pattern found in 89 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO ", "shortDescription": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5039", "name": "stdlib: GO-2026-5039", "shortDescription": {"text": "stdlib: GO-2026-5039"}, "fullDescription": {"text": "Arbitrary inputs are included in errors without any escaping in net/textproto"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5038", "name": "stdlib: GO-2026-5038", "shortDescription": {"text": "stdlib: GO-2026-5038"}, "fullDescription": {"text": "Quadratic complexity in WordDecoder.DecodeHeader in mime"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5037", "name": "stdlib: GO-2026-5037", "shortDescription": {"text": "stdlib: GO-2026-5037"}, "fullDescription": {"text": "Inefficient candidate hostname parsing in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4986", "name": "stdlib: GO-2026-4986", "shortDescription": {"text": "stdlib: GO-2026-4986"}, "fullDescription": {"text": "Quadratic string concatentation in consumeComment in net/mail"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4982", "name": "stdlib: GO-2026-4982", "shortDescription": {"text": "stdlib: GO-2026-4982"}, "fullDescription": {"text": "Bypass of meta content URL escaping causes XSS in html/template"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4981", "name": "stdlib: GO-2026-4981", "shortDescription": {"text": "stdlib: GO-2026-4981"}, "fullDescription": {"text": "Crash when handling long CNAME response in net"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4980", "name": "stdlib: GO-2026-4980", "shortDescription": {"text": "stdlib: GO-2026-4980"}, "fullDescription": {"text": "Escaper bypass leads to XSS in html/template"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4977", "name": "stdlib: GO-2026-4977", "shortDescription": {"text": "stdlib: GO-2026-4977"}, "fullDescription": {"text": "Quadratic string concatenation in consumePhrase in net/mail"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4976", "name": "stdlib: GO-2026-4976", "shortDescription": {"text": "stdlib: GO-2026-4976"}, "fullDescription": {"text": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4971", "name": "stdlib: GO-2026-4971", "shortDescription": {"text": "stdlib: GO-2026-4971"}, "fullDescription": {"text": "Panic in Dial and LookupPort when handling NUL byte on Windows in net"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4947", "name": "stdlib: GO-2026-4947", "shortDescription": {"text": "stdlib: GO-2026-4947"}, "fullDescription": {"text": "Unexpected work during chain building in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4946", "name": "stdlib: GO-2026-4946", "shortDescription": {"text": "stdlib: GO-2026-4946"}, "fullDescription": {"text": "Inefficient policy validation in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4918", "name": "stdlib: GO-2026-4918", "shortDescription": {"text": "stdlib: GO-2026-4918"}, "fullDescription": {"text": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4870", "name": "stdlib: GO-2026-4870", "shortDescription": {"text": "stdlib: GO-2026-4870"}, "fullDescription": {"text": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4869", "name": "stdlib: GO-2026-4869", "shortDescription": {"text": "stdlib: GO-2026-4869"}, "fullDescription": {"text": "Unbounded allocation for old GNU sparse in archive/tar"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4865", "name": "stdlib: GO-2026-4865", "shortDescription": {"text": "stdlib: GO-2026-4865"}, "fullDescription": {"text": "JsBraceDepth Context Tracking Bugs (XSS) in html/template"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4864", "name": "stdlib: GO-2026-4864", "shortDescription": {"text": "stdlib: GO-2026-4864"}, "fullDescription": {"text": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4603", "name": "stdlib: GO-2026-4603", "shortDescription": {"text": "stdlib: GO-2026-4603"}, "fullDescription": {"text": "URLs in meta content attribute actions are not escaped in html/template"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4602", "name": "stdlib: GO-2026-4602", "shortDescription": {"text": "stdlib: GO-2026-4602"}, "fullDescription": {"text": "FileInfo can escape from a Root in os"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4601", "name": "stdlib: GO-2026-4601", "shortDescription": {"text": "stdlib: GO-2026-4601"}, "fullDescription": {"text": "Incorrect parsing of IPv6 host literals in net/url"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4342", "name": "stdlib: GO-2026-4342", "shortDescription": {"text": "stdlib: GO-2026-4342"}, "fullDescription": {"text": "Excessive CPU consumption when building archive index in archive/zip"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4341", "name": "stdlib: GO-2026-4341", "shortDescription": {"text": "stdlib: GO-2026-4341"}, "fullDescription": {"text": "Memory exhaustion in query parameter parsing in net/url"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4340", "name": "stdlib: GO-2026-4340", "shortDescription": {"text": "stdlib: GO-2026-4340"}, "fullDescription": {"text": "Handshake messages may be processed at the incorrect encryption level in crypto/tls"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4337", "name": "stdlib: GO-2026-4337", "shortDescription": {"text": "stdlib: GO-2026-4337"}, "fullDescription": {"text": "Unexpected session resumption in crypto/tls"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4175", "name": "stdlib: GO-2025-4175", "shortDescription": {"text": "stdlib: GO-2025-4175"}, "fullDescription": {"text": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4155", "name": "stdlib: GO-2025-4155", "shortDescription": {"text": "stdlib: GO-2025-4155"}, "fullDescription": {"text": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4015", "name": "stdlib: GO-2025-4015", "shortDescription": {"text": "stdlib: GO-2025-4015"}, "fullDescription": {"text": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4014", "name": "stdlib: GO-2025-4014", "shortDescription": {"text": "stdlib: GO-2025-4014"}, "fullDescription": {"text": "Unbounded allocation when parsing GNU sparse map in archive/tar"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4013", "name": "stdlib: GO-2025-4013", "shortDescription": {"text": "stdlib: GO-2025-4013"}, "fullDescription": {"text": "Panic when validating certificates with DSA public keys in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4012", "name": "stdlib: GO-2025-4012", "shortDescription": {"text": "stdlib: GO-2025-4012"}, "fullDescription": {"text": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4011", "name": "stdlib: GO-2025-4011", "shortDescription": {"text": "stdlib: GO-2025-4011"}, "fullDescription": {"text": "Parsing DER payload can cause memory exhaustion in encoding/asn1"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4010", "name": "stdlib: GO-2025-4010", "shortDescription": {"text": "stdlib: GO-2025-4010"}, "fullDescription": {"text": "Insufficient validation of bracketed IPv6 hostnames in net/url"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4009", "name": "stdlib: GO-2025-4009", "shortDescription": {"text": "stdlib: GO-2025-4009"}, "fullDescription": {"text": "Quadratic complexity when parsing some invalid inputs in encoding/pem"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4008", "name": "stdlib: GO-2025-4008", "shortDescription": {"text": "stdlib: GO-2025-4008"}, "fullDescription": {"text": "ALPN negotiation error contains attacker controlled information in crypto/tls"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4007", "name": "stdlib: GO-2025-4007", "shortDescription": {"text": "stdlib: GO-2025-4007"}, "fullDescription": {"text": "Quadratic complexity when checking name constraints in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4006", "name": "stdlib: GO-2025-4006", "shortDescription": {"text": "stdlib: GO-2025-4006"}, "fullDescription": {"text": "Excessive CPU consumption in ParseAddress in net/mail"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3956", "name": "stdlib: GO-2025-3956", "shortDescription": {"text": "stdlib: GO-2025-3956"}, "fullDescription": {"text": "Unexpected paths returned from LookPath in os/exec"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3849", "name": "stdlib: GO-2025-3849", "shortDescription": {"text": "stdlib: GO-2025-3849"}, "fullDescription": {"text": "Incorrect results returned from Rows.Scan in database/sql"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5024", "name": "golang.org/x/sys: GO-2026-5024", "shortDescription": {"text": "golang.org/x/sys: GO-2026-5024"}, "fullDescription": {"text": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4403", "name": "stdlib: GO-2026-4403", "shortDescription": {"text": "stdlib: GO-2026-4403"}, "fullDescription": {"text": "Improper access to parent directory of root in os"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3751", "name": "stdlib: GO-2025-3751", "shortDescription": {"text": "stdlib: GO-2025-3751"}, "fullDescription": {"text": "Sensitive headers not cleared on cross-origin redirect in net/http"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3750", "name": "stdlib: GO-2025-3750", "shortDescription": {"text": "stdlib: GO-2025-3750"}, "fullDescription": {"text": "Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3749", "name": "stdlib: GO-2025-3749", "shortDescription": {"text": "stdlib: GO-2025-3749"}, "fullDescription": {"text": "Usage of ExtKeyUsageAny disables policy validation in crypto/x509"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3563", "name": "stdlib: GO-2025-3563", "shortDescription": {"text": "stdlib: GO-2025-3563"}, "fullDescription": {"text": "Request smuggling due to acceptance of invalid chunked data in net/http"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3503", "name": "stdlib: GO-2025-3503", "shortDescription": {"text": "stdlib: GO-2025-3503"}, "fullDescription": {"text": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-69v7-xpr6-6gjm", "name": "lupa: GHSA-69v7-xpr6-6gjm", "shortDescription": {"text": "lupa: GHSA-69v7-xpr6-6gjm"}, "fullDescription": {"text": "Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2023-117", "name": "pygments: PYSEC-2023-117", "shortDescription": {"text": "pygments: PYSEC-2023-117"}, "fullDescription": {"text": "A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-3955", "name": "stdlib: GO-2025-3955", "shortDescription": {"text": "stdlib: GO-2025-3955"}, "fullDescription": {"text": "CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5030", "name": "golang.org/x/net: GO-2026-5030", "shortDescription": {"text": "golang.org/x/net: GO-2026-5030"}, "fullDescription": {"text": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5029", "name": "golang.org/x/net: GO-2026-5029", "shortDescription": {"text": "golang.org/x/net: GO-2026-5029"}, "fullDescription": {"text": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5028", "name": "golang.org/x/net: GO-2026-5028", "shortDescription": {"text": "golang.org/x/net: GO-2026-5028"}, "fullDescription": {"text": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5027", "name": "golang.org/x/net: GO-2026-5027", "shortDescription": {"text": "golang.org/x/net: GO-2026-5027"}, "fullDescription": {"text": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5026", "name": "golang.org/x/net: GO-2026-5026", "shortDescription": {"text": "golang.org/x/net: GO-2026-5026"}, "fullDescription": {"text": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5025", "name": "golang.org/x/net: GO-2026-5025", "shortDescription": {"text": "golang.org/x/net: GO-2026-5025"}, "fullDescription": {"text": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4441", "name": "golang.org/x/net: GO-2026-4441", "shortDescription": {"text": "golang.org/x/net: GO-2026-4441"}, "fullDescription": {"text": "Infinite parsing loop in golang.org/x/net"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-4440", "name": "golang.org/x/net: GO-2026-4440", "shortDescription": {"text": "golang.org/x/net: GO-2026-4440"}, "fullDescription": {"text": "Quadratic parsing complexity in golang.org/x/net/html"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5033", "name": "golang.org/x/crypto: GO-2026-5033", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5033"}, "fullDescription": {"text": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5023", "name": "golang.org/x/crypto: GO-2026-5023", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5023"}, "fullDescription": {"text": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5021", "name": "golang.org/x/crypto: GO-2026-5021", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5021"}, "fullDescription": {"text": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5020", "name": "golang.org/x/crypto: GO-2026-5020", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5020"}, "fullDescription": {"text": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5019", "name": "golang.org/x/crypto: GO-2026-5019", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5019"}, "fullDescription": {"text": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5018", "name": "golang.org/x/crypto: GO-2026-5018", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5018"}, "fullDescription": {"text": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5017", "name": "golang.org/x/crypto: GO-2026-5017", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5017"}, "fullDescription": {"text": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5016", "name": "golang.org/x/crypto: GO-2026-5016", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5016"}, "fullDescription": {"text": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5015", "name": "golang.org/x/crypto: GO-2026-5015", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5015"}, "fullDescription": {"text": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5014", "name": "golang.org/x/crypto: GO-2026-5014", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5014"}, "fullDescription": {"text": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5013", "name": "golang.org/x/crypto: GO-2026-5013", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5013"}, "fullDescription": {"text": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5006", "name": "golang.org/x/crypto: GO-2026-5006", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5006"}, "fullDescription": {"text": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2026-5005", "name": "golang.org/x/crypto: GO-2026-5005", "shortDescription": {"text": "golang.org/x/crypto: GO-2026-5005"}, "fullDescription": {"text": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4135", "name": "golang.org/x/crypto: GO-2025-4135", "shortDescription": {"text": "golang.org/x/crypto: GO-2025-4135"}, "fullDescription": {"text": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4134", "name": "golang.org/x/crypto: GO-2025-4134", "shortDescription": {"text": "golang.org/x/crypto: GO-2025-4134"}, "fullDescription": {"text": "Unbounded memory consumption in golang.org/x/crypto/ssh"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GO-2025-4116", "name": "golang.org/x/crypto: GO-2025-4116", "shortDescription": {"text": "golang.org/x/crypto: GO-2025-4116"}, "fullDescription": {"text": "Potential denial of service in golang.org/x/crypto/ssh/agent"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC011", "name": "Database service publishes a host port", "shortDescription": {"text": "Database service publishes a host port"}, "fullDescription": {"text": "Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "DKC003", "name": "Compose service joins the host PID namespace", "shortDescription": {"text": "Compose service joins the host PID namespace"}, "fullDescription": {"text": "Sharing host namespaces reduces isolation and can expose host processes, networking, or IPC resources."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKC009", "name": "Compose service bind-mounts a sensitive host path", "shortDescription": {"text": "Compose service bind-mounts a sensitive host path"}, "fullDescription": {"text": "Mounting broad host paths exposes host files to the container and can turn app compromise into host compromise."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED016", "name": "[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern.", "shortDescription": {"text": "[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-754 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC078", "name": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsiv", "shortDescription": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a re"}, "fullDescription": {"text": "Add `timeout=10` (or appropriate value) to every requests call."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled ", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes e"}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED001", "name": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInt", "shortDescription": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED126", "name": "Workflow container/services image `ghcr.io/romange/benchmark-dev:latest` unpinned", "shortDescription": {"text": "Workflow container/services image `ghcr.io/romange/benchmark-dev:latest` unpinned"}, "fullDescription": {"text": "`container/services image: ghcr.io/romange/benchmark-dev:latest` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "Dockerfile FROM `ubuntu:22.04` not pinned by digest", "shortDescription": {"text": "Dockerfile FROM `ubuntu:22.04` not pinned by digest"}, "fullDescription": {"text": "`FROM ubuntu:22.04` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED131", "name": "pre-commit hook `https://github.com/psf/black` pinned to mutable rev `25.1.0`", "shortDescription": {"text": "pre-commit hook `https://github.com/psf/black` pinned to mutable rev `25.1.0`"}, "fullDescription": {"text": "`.pre-commit-config.yaml` references `https://github.com/psf/black` at `rev: 25.1.0`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED108", "name": "`self.replication_groups` used but never assigned in __init__", "shortDescription": {"text": "`self.replication_groups` used but never assigned in __init__"}, "fullDescription": {"text": "Method `get_primary_port` of class `ValkeySearchClusterTestCase` reads `self.replication_groups`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED106", "name": "Phantom test coverage: test_standard_benchmark", "shortDescription": {"text": "Phantom test coverage: test_standard_benchmark"}, "fullDescription": {"text": "Test function `test_standard_benchmark` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED110", "name": "Blocking call `time.sleep` inside async function `test_heartbeat_eviction_propagation`", "shortDescription": {"text": "Blocking call `time.sleep` inside async function `test_heartbeat_eviction_propagation`"}, "fullDescription": {"text": "`time.sleep` is a synchronous (blocking) call. When invoked inside an `async def` it stalls the event loop, preventing every other coroutine in the process from making progress."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "generic-api-key", "name": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", "shortDescription": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "fullDescription": {"text": "Gitleaks detected a committed secret or credential pattern."}, "properties": {"scanner": "gitleaks", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "private-key", "name": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.", "shortDescription": {"text": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption."}, "fullDescription": {"text": "Gitleaks detected a committed secret or credential pattern."}, "properties": {"scanner": "gitleaks", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "kubernetes-secret-yaml", "name": "Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments", "shortDescription": {"text": "Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments"}, "fullDescription": {"text": "Gitleaks detected a committed secret or credential pattern."}, "properties": {"scanner": "gitleaks", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "Missing import: `queue` used but not imported", "shortDescription": {"text": "Missing import: `queue` used but not imported"}, "fullDescription": {"text": "The file uses `queue.something(...)` but never imports `queue`. This raises NameError at runtime the first time the line executes."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25508"}, "properties": {"repository": "dragonflydb/dragonfly", "repoUrl": "https://github.com/dragonflydb/dragonfly", "branch": "main"}, "results": [{"ruleId": "GHSA-65pc-fj4g-8rjx", "level": "warning", "message": {"text": "idna: GHSA-65pc-fj4g-8rjx"}, "properties": {"repobilityId": 224508, "scanner": "osv-scanner", "fingerprint": "ec1f94bf89995eff01f6042962675fb8e5d1cfc61d53e60dbf986a0c0c5333d8", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45409"], "package": "idna", "rule_id": "GHSA-65pc-fj4g-8rjx", "scanner": "osv-scanner", "correlation_key": "vuln|idna|CVE-2024-3651|tools/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-65pc-fj4g-8rjx", "level": "warning", "message": {"text": "idna: GHSA-65pc-fj4g-8rjx"}, "properties": {"repobilityId": 224410, "scanner": "osv-scanner", "fingerprint": "06c68af29949df7149d349fa1a53ee6aa249477b542f0fa1c9adbfb9d65a1c30", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45409"], "package": "idna", "rule_id": "GHSA-65pc-fj4g-8rjx", "scanner": "osv-scanner", "correlation_key": "vuln|idna|CVE-2024-3651|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `renderer` image uses the latest tag"}, "properties": {"repobilityId": 224314, "scanner": "repobility-docker", "fingerprint": "e6d9f7ca66f32f72f8706703041e6b2f2321fe52995987e4b88571ad35414394", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "grafana/grafana-image-renderer:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|e6d9f7ca66f32f72f8706703041e6b2f2321fe52995987e4b88571ad35414394"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 117}}}]}, {"ruleId": "DKC013", "level": "warning", "message": {"text": "Database service has no persistent data volume"}, "properties": {"repobilityId": 224312, "scanner": "repobility-docker", "fingerprint": "7f892731390aeafabc8d9919c08d507ca87f06e9a7864e0818ad336957704861", "category": "docker", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like service does not mount a known data directory.", "evidence": {"rule_id": "DKC013", "scanner": "repobility-docker", "service": "redis-exporter", "references": ["https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|7f892731390aeafabc8d9919c08d507ca87f06e9a7864e0818ad336957704861", "expected_targets": ["/data"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Compose service `redis-exporter` image has no explicit tag"}, "properties": {"repobilityId": 224310, "scanner": "repobility-docker", "fingerprint": "af46a1725d118fe5b0a4e3433090ceef0693887c3e4a03f2b1d85813c5c2c1b6", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "quay.io/oliver006/redis_exporter", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|af46a1725d118fe5b0a4e3433090ceef0693887c3e4a03f2b1d85813c5c2c1b6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Compose service `memcached-exporter` image has no explicit tag"}, "properties": {"repobilityId": 224306, "scanner": "repobility-docker", "fingerprint": "cffced9205d3a604f247a7df32b7c4093ab8958a92a9cac8f2c3b1cba3f1b8e5", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "prom/memcached-exporter", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|cffced9205d3a604f247a7df32b7c4093ab8958a92a9cac8f2c3b1cba3f1b8e5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Compose service `node-exporter` image has no explicit tag"}, "properties": {"repobilityId": 224301, "scanner": "repobility-docker", "fingerprint": "dc07fc0a2fde0e5631d693fe1278257e5450e472260c7296fa4d614d4e5bfdfd", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "prom/node-exporter", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|dc07fc0a2fde0e5631d693fe1278257e5450e472260c7296fa4d614d4e5bfdfd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Compose service `memcached` image has no explicit tag"}, "properties": {"repobilityId": 224297, "scanner": "repobility-docker", "fingerprint": "21d5e26fff6b383dd0e1f301ceae6edcd9a3ea9f7e36d601308f0b1e2fa2bb76", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "memcached", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|21d5e26fff6b383dd0e1f301ceae6edcd9a3ea9f7e36d601308f0b1e2fa2bb76"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Compose service `change_vol_ownership` image has no explicit tag"}, "properties": {"repobilityId": 224293, "scanner": "repobility-docker", "fingerprint": "cf07054572596ad23e36020dc420a646bfb2c65c320634241e55153ad70bd53d", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "alpine", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|cf07054572596ad23e36020dc420a646bfb2c65c320634241e55153ad70bd53d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Compose service `dragonfly` image has no explicit tag"}, "properties": {"repobilityId": 224290, "scanner": "repobility-docker", "fingerprint": "fc429a41d3723589b1ea4f7b98e4411e6bc68d7c35fa74b5404768f7fdca8881", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "docker.dragonflydb.io/dragonflydb/dragonfly", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|fc429a41d3723589b1ea4f7b98e4411e6bc68d7c35fa74b5404768f7fdca8881"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/docker/docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 224289, "scanner": "repobility-docker", "fingerprint": "88eb432d6ab1f95192b5cecc5f8fdb2e97cda875a4f910c92f80acdde2598d4e", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "ubuntu:22.04", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|88eb432d6ab1f95192b5cecc5f8fdb2e97cda875a4f910c92f80acdde2598d4e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.ubuntu-prod"}, "region": {"startLine": 13}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 224288, "scanner": "repobility-docker", "fingerprint": "fa4c42a46595dc4a6dfbce545ee9f6c3963f06c71cffcf704c4b0e5a141b75cb", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "ubuntu:22.04", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|fa4c42a46595dc4a6dfbce545ee9f6c3963f06c71cffcf704c4b0e5a141b75cb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.ubuntu-dev"}, "region": {"startLine": 17}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Dockerfile base image has no explicit tag"}, "properties": {"repobilityId": 224287, "scanner": "repobility-docker", "fingerprint": "397f72ba561a19d5fb3e5ec2c6e8f968c4ea70e6c0ea3f4ebe548baddeaba115", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "gcr.io/distroless/cc-debian12", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|397f72ba561a19d5fb3e5ec2c6e8f968c4ea70e6c0ea3f4ebe548baddeaba115"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-prod"}, "region": {"startLine": 26}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Dockerfile base image has no explicit tag"}, "properties": {"repobilityId": 224286, "scanner": "repobility-docker", "fingerprint": "5660b33ecd1c9ec573034bd45d868d5e925c7db72dd6f35af39a3b4d8dc18efa", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "alpine", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|5660b33ecd1c9ec573034bd45d868d5e925c7db72dd6f35af39a3b4d8dc18efa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-prod"}, "region": {"startLine": 17}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Dockerfile base image has no explicit tag"}, "properties": {"repobilityId": 224285, "scanner": "repobility-docker", "fingerprint": "477ac22ee1040dbcfcbca810f9f75d3aacaa78464183eed71833c41f7415cca9", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "gcr.io/distroless/cc-debian12", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|477ac22ee1040dbcfcbca810f9f75d3aacaa78464183eed71833c41f7415cca9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-dev"}, "region": {"startLine": 33}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Dockerfile base image has no explicit tag"}, "properties": {"repobilityId": 224284, "scanner": "repobility-docker", "fingerprint": "85f11a32e21c070516864bf786ebc8684c64d43cb50ee765b04febb6cbee610b", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "alpine", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|85f11a32e21c070516864bf786ebc8684c64d43cb50ee765b04febb6cbee610b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-dev"}, "region": {"startLine": 24}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 224282, "scanner": "repobility-docker", "fingerprint": "6d72993b83d8e906745ce472146a795015891ac7ce8c0e69147b7756a23223f3", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "alpine:3", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|6d72993b83d8e906745ce472146a795015891ac7ce8c0e69147b7756a23223f3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.alpine-dev"}, "region": {"startLine": 31}}}]}, {"ruleId": "DKR018", "level": "warning", "message": {"text": "Database dump or local database file is included in Docker build context"}, "properties": {"repobilityId": 224281, "scanner": "repobility-docker", "fingerprint": "655485f8d8d660f19955b099504360fbf5ff0f88b2be2fc7d9501b5ab7e7369f", "category": "docker", "severity": "medium", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Database-like artifacts are reachable from the Docker build context and are not ignored.", "evidence": {"rule_id": "DKR018", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|655485f8d8d660f19955b099504360fbf5ff0f88b2be2fc7d9501b5ab7e7369f", "database_artifacts": [{"path": "src/server/testdata/redis6_stream.rdb", "size_mb": 0.0}, {"path": "src/server/testdata/redis6_small.rdb", "size_mb": 0.0}, {"path": "src/server/testdata/redis_json.rdb", "size_mb": 0.0}, {"path": "src/server/testdata/hll.rdb", "size_mb": 0.0}, {"path": "src/server/testdata/RDB_TYPE_STREAM_LISTPACKS_3.rdb", "size_mb": 0.0}]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 224267, "scanner": "repobility-threat-engine", "fingerprint": "0273ea392cfebe2188ae238a7d992371cdd1cc1478347a9ace1e35a6177a208a", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Eval(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|src/server/main_service.h|135|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/main_service.h"}, "region": {"startLine": 135}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 224266, "scanner": "repobility-threat-engine", "fingerprint": "adf725eb1a62abe40d173865fdf8fb23126bc9ccc2eece1aade5226cf5f25953", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|src/server/debugcmd.h|50|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/debugcmd.h"}, "region": {"startLine": 50}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 224265, "scanner": "repobility-threat-engine", "fingerprint": "9032ac1ca6accc632374bc910cfaa753e48b61007ad2b59285bb1591dbc65308", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|33|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/cluster/coordinator.cc"}, "region": {"startLine": 33}}}]}, {"ruleId": "SEC134", "level": "warning", "message": {"text": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets to swap them. In production, these break demo flows, send mail to a real example.com host (it's owned by IANA), and leak that the codebase had an AI scaffolding pass."}, "properties": {"repobilityId": 224259, "scanner": "repobility-threat-engine", "fingerprint": "ee38a0be6c7dc569cb8b173635c67612e03067d6aa81613a07a32d7c9a50d5a3", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"Lorem ipsum dolor sit amet", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC134", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|ee38a0be6c7dc569cb8b173635c67612e03067d6aa81613a07a32d7c9a50d5a3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/redis/crc64.c"}, "region": {"startLine": 139}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 224242, "scanner": "repobility-threat-engine", "fingerprint": "bf1623e2a5a2d6faa7ec98864ec3b92f777b291501af3826b78aa1b6beb37095", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n        pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|bf1623e2a5a2d6faa7ec98864ec3b92f777b291501af3826b78aa1b6beb37095"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/replay_crash.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "SEC015", "level": "warning", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 224241, "scanner": "repobility-threat-engine", "fingerprint": "708c2e48f8f233461677bcf401d4699c62cf6a11c1471743bc6bf56c31d8a6fa", "category": "crypto", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "evidence": {"match": "random.choice(all_key_lens, p=key", "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|crypto|tools/eviction/fill_db.py|63|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/eviction/fill_db.py"}, "region": {"startLine": 63}}}]}, {"ruleId": "SEC015", "level": "warning", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 224240, "scanner": "repobility-threat-engine", "fingerprint": "4cb2860c15b2dcb6d9ca5f5cf3d70628e40edfbe6dd71c00070b6e25c37177b2", "category": "crypto", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "evidence": {"match": "key_idx = random.randint", "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|crypto|fuzz/memcache_mutator.py|260|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/memcache_mutator.py"}, "region": {"startLine": 260}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `pytest-asyncio` is 1 major version(s) behind (0.20.1 -> 1.4.0)"}, "properties": {"repobilityId": 224227, "scanner": "repobility-dependency-currency", "fingerprint": "79bb3ded5ae8cf37d032efb2882eb2a63d68f5f91b9de31f48ab5ea4ec670d67", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest-asyncio", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "1.4.0", "correlation_key": "fp|79bb3ded5ae8cf37d032efb2882eb2a63d68f5f91b9de31f48ab5ea4ec670d67", "current_version": "0.20.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/requirements.txt"}, "region": {"startLine": 13}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `redis` is 3 major version(s) behind (5.2.1 -> 8.0.0)"}, "properties": {"repobilityId": 224224, "scanner": "repobility-dependency-currency", "fingerprint": "ac56111fe4542f85290bf1dabbd55362a3a14631107d9be8f5e48892204d80ef", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "3 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "redis", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "8.0.0", "correlation_key": "fp|ac56111fe4542f85290bf1dabbd55362a3a14631107d9be8f5e48892204d80ef", "current_version": "5.2.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `pytest-cov` is 2 major version(s) behind (5.0.0 -> 7.1.0)"}, "properties": {"repobilityId": 224220, "scanner": "repobility-dependency-currency", "fingerprint": "c6aeb90572a27a131a7e03840e44e391888e05ef5f5fb0a4f65b1f25aacd9a3b", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "2 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest-cov", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "7.1.0", "correlation_key": "fp|c6aeb90572a27a131a7e03840e44e391888e05ef5f5fb0a4f65b1f25aacd9a3b", "current_version": "5.0.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `packaging` is 2 major version(s) behind (24.2 -> 26.2)"}, "properties": {"repobilityId": 224215, "scanner": "repobility-dependency-currency", "fingerprint": "7b168edd181abf7e92da5016a58bfb791f2556aba626881c374fa5c0c679b9e9", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "2 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "packaging", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "26.2", "correlation_key": "fp|7b168edd181abf7e92da5016a58bfb791f2556aba626881c374fa5c0c679b9e9", "current_version": "24.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `attrs` is 1 major version(s) behind (25.3.0 -> 26.1.0)"}, "properties": {"repobilityId": 224208, "scanner": "repobility-dependency-currency", "fingerprint": "88d2534d651ca7a24ef7a84e9729e7e9681e403413d796693161141576ae8d5e", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "attrs", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "26.1.0", "correlation_key": "fp|88d2534d651ca7a24ef7a84e9729e7e9681e403413d796693161141576ae8d5e", "current_version": "25.3.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `aiofiles` is 3 major version(s) behind (22.1.0 -> 25.1.0)"}, "properties": {"repobilityId": 224207, "scanner": "repobility-dependency-currency", "fingerprint": "1658b9bd6b2518f780f9a1cf0828d5721f10de603e262cbed413061dc8c37325", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "3 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "aiofiles", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "25.1.0", "correlation_key": "fp|1658b9bd6b2518f780f9a1cf0828d5721f10de603e262cbed413061dc8c37325", "current_version": "22.1.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/requirements.txt"}, "region": {"startLine": 9}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `redis` is 4 major version(s) behind (4.4.4 -> 8.0.0)"}, "properties": {"repobilityId": 224205, "scanner": "repobility-dependency-currency", "fingerprint": "8c35955611e6eba1d24cb131509bb5fe9909cc4b96c11969f61bdcfb0b7e6d18", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "4 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "redis", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "8.0.0", "correlation_key": "fp|8c35955611e6eba1d24cb131509bb5fe9909cc4b96c11969f61bdcfb0b7e6d18", "current_version": "4.4.4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/requirements.txt"}, "region": {"startLine": 6}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `async_timeout` is 1 major version(s) behind (4.0.2 -> 5.0.1)"}, "properties": {"repobilityId": 224203, "scanner": "repobility-dependency-currency", "fingerprint": "7c684ebdf2862cc1bafbc28da6733f7fe736687380289767d827a143697cffd5", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "async_timeout", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.0.1", "correlation_key": "fp|7c684ebdf2862cc1bafbc28da6733f7fe736687380289767d827a143697cffd5", "current_version": "4.0.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/requirements.txt"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `codecov/codecov-action` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224185, "scanner": "repobility-supply-chain", "fingerprint": "bf60f0f98cf041c5109759915ce394ae8d058e3a53885d64719bc3fecf949868", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|bf60f0f98cf041c5109759915ce394ae8d058e3a53885d64719bc3fecf949868"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cov.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `aws-actions/configure-aws-credentials` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224176, "scanner": "repobility-supply-chain", "fingerprint": "d1b3c065054e6a646ed6e42212dc4276f5415deca68ea24406e7d5f0cf9be14c", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d1b3c065054e6a646ed6e42212dc4276f5415deca68ea24406e7d5f0cf9be14c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/epoll-regression-tests.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `aws-actions/configure-aws-credentials` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224172, "scanner": "repobility-supply-chain", "fingerprint": "296ef0d43b5638bc1fce5d5a0e0459bdd114ad0e2c61c97c34312ca759da9e13", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|296ef0d43b5638bc1fce5d5a0e0459bdd114ad0e2c61c97c34312ca759da9e13"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/regression-tests.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "Action `mikepenz/action-junit-report` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224161, "scanner": "repobility-supply-chain", "fingerprint": "079541ccc3cc5fd332bda1c917ec43795173c97208eb53480f428c972ea20b0d", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|079541ccc3cc5fd332bda1c917ec43795173c97208eb53480f428c972ea20b0d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `numpy` has no version pin"}, "properties": {"repobilityId": 224141, "scanner": "repobility-supply-chain", "fingerprint": "74b4394ed589bf04db33fad304c0e07dc0eaebba02382b62342c5ba55a30edfb", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|74b4394ed589bf04db33fad304c0e07dc0eaebba02382b62342c5ba55a30edfb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/requirements.txt"}, "region": {"startLine": 19}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224137, "scanner": "repobility-ast-engine", "fingerprint": "aea29eb16e9a365bb4a9a43e4ee7c69d5c482e4bd71352d88819ab5caa686c89", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|aea29eb16e9a365bb4a9a43e4ee7c69d5c482e4bd71352d88819ab5caa686c89"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/pubsub/celery-test.py"}, "region": {"startLine": 311}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224136, "scanner": "repobility-ast-engine", "fingerprint": "ae9cba88a827ea7ee889dce966dfb1a8b6cd14e9c1c7d9de9b22fd27ce8d7ee9", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ae9cba88a827ea7ee889dce966dfb1a8b6cd14e9c1c7d9de9b22fd27ce8d7ee9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/pubsub/celery-test.py"}, "region": {"startLine": 234}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224115, "scanner": "repobility-ast-engine", "fingerprint": "d0490e28769986e63e0082ae7f67c082f4187b3715c00937f2b37ea8dcd7cc4d", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|d0490e28769986e63e0082ae7f67c082f4187b3715c00937f2b37ea8dcd7cc4d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/eval_test.py"}, "region": {"startLine": 510}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224114, "scanner": "repobility-ast-engine", "fingerprint": "e8446efb4e23c8e56b1a2349f62a62ae37d0377fee7da7f9fb24b93a7bab926a", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e8446efb4e23c8e56b1a2349f62a62ae37d0377fee7da7f9fb24b93a7bab926a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/eval_test.py"}, "region": {"startLine": 499}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224106, "scanner": "repobility-ast-engine", "fingerprint": "e61edf8e94c79a0c2726b71bbe22468c5f678be0a60b2947bbebe634543cb10c", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e61edf8e94c79a0c2726b71bbe22468c5f678be0a60b2947bbebe634543cb10c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/shutdown_test.py"}, "region": {"startLine": 103}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224101, "scanner": "repobility-ast-engine", "fingerprint": "86ef7b0e1ad3e5239bc4ba220d863b736b3f8a173b94e7bfff36129bae5ac937", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|86ef7b0e1ad3e5239bc4ba220d863b736b3f8a173b94e7bfff36129bae5ac937"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 1651}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224100, "scanner": "repobility-ast-engine", "fingerprint": "c9ca583ea332785be00261e7e10e28e2b14338e79b35081f9121348e3313db42", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c9ca583ea332785be00261e7e10e28e2b14338e79b35081f9121348e3313db42"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 5024}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224099, "scanner": "repobility-ast-engine", "fingerprint": "5081e9fd82866e0a75f975874e0d10ab652df9c1813df359752b236704aed32a", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5081e9fd82866e0a75f975874e0d10ab652df9c1813df359752b236704aed32a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 5012}}}]}, {"ruleId": "MINED109", "level": "warning", "message": {"text": "Mutable default argument in `__init__` (list)"}, "properties": {"repobilityId": 224085, "scanner": "repobility-ast-engine", "fingerprint": "fc9f5c73f70dfc413c5888bc04bebb21c54b4ff45b22fa0212d07f05551252a4", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "mutable-default-arg", "owasp": null, "cwe_ids": ["CWE-1023"], "languages": ["python"], "observations_count": 64867}, "scanner": "repobility-ast-engine", "correlation_key": "fp|fc9f5c73f70dfc413c5888bc04bebb21c54b4ff45b22fa0212d07f05551252a4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/utility.py"}, "region": {"startLine": 514}}}]}, {"ruleId": "MINED109", "level": "warning", "message": {"text": "Mutable default argument in `__init__` (list)"}, "properties": {"repobilityId": 224084, "scanner": "repobility-ast-engine", "fingerprint": "cb3fdebe64c04c9539cb8b9e8bcc3cc67901104787d4f5c5ffe90d52adf46a9c", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "mutable-default-arg", "owasp": null, "cwe_ids": ["CWE-1023"], "languages": ["python"], "observations_count": 64867}, "scanner": "repobility-ast-engine", "correlation_key": "fp|cb3fdebe64c04c9539cb8b9e8bcc3cc67901104787d4f5c5ffe90d52adf46a9c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/utility.py"}, "region": {"startLine": 193}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224070, "scanner": "repobility-ast-engine", "fingerprint": "e7c2f1968362d41853a567d0da4e5de28409d3f64ae688e97e35a65299aa1c5a", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e7c2f1968362d41853a567d0da4e5de28409d3f64ae688e97e35a65299aa1c5a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/search_test.py"}, "region": {"startLine": 1245}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224065, "scanner": "repobility-ast-engine", "fingerprint": "bde19b1ecfdd7dd80631b88ae4f77e653ad4471d3a95c24f4fc5351914326bcb", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|bde19b1ecfdd7dd80631b88ae4f77e653ad4471d3a95c24f4fc5351914326bcb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/conftest.py"}, "region": {"startLine": 325}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224057, "scanner": "repobility-ast-engine", "fingerprint": "75093dfcfdf1dc5f5a10533f20f6a33d43390e1dc25b6d2eb75fc51973f0c282", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|75093dfcfdf1dc5f5a10533f20f6a33d43390e1dc25b6d2eb75fc51973f0c282"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 275}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 224055, "scanner": "repobility-ast-engine", "fingerprint": "d098084106c272f823fe8335fd26949a4ba76b7d3692f3481b092d4d98637b48", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|d098084106c272f823fe8335fd26949a4ba76b7d3692f3481b092d4d98637b48"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/defrag_mem_test.py"}, "region": {"startLine": 100}}}]}, {"ruleId": "GHSA-5239-wwwm-4pmq", "level": "note", "message": {"text": "pygments: GHSA-5239-wwwm-4pmq"}, "properties": {"repobilityId": 224412, "scanner": "osv-scanner", "fingerprint": "2ecab0f5706f174d522404e450fe214b51929c6b3bc9f2bda12516566f2a77c8", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-4539"], "package": "pygments", "rule_id": "GHSA-5239-wwwm-4pmq", "scanner": "osv-scanner", "correlation_key": "vuln|pygments|CVE-2026-4539|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224316, "scanner": "repobility-docker", "fingerprint": "2856500058c83287e15b1cade848aef2200d8b8860f7aa48283c8d004621e01a", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "renderer", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|2856500058c83287e15b1cade848aef2200d8b8860f7aa48283c8d004621e01a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 117}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 224315, "scanner": "repobility-docker", "fingerprint": "2c1020585ca99ebfae169a448d0f3df30a3f1756fb2b01ad1fab0e59a3050e6b", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "renderer", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|2c1020585ca99ebfae169a448d0f3df30a3f1756fb2b01ad1fab0e59a3050e6b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 117}}}]}, {"ruleId": "DKC015", "level": "note", "message": {"text": "Database service has no healthcheck"}, "properties": {"repobilityId": 224313, "scanner": "repobility-docker", "fingerprint": "ca04a12e16bef57e046cf970e459e5a67756f1a141cb895f5b52f13fe6296cef", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like service has no Compose healthcheck.", "evidence": {"rule_id": "DKC015", "scanner": "repobility-docker", "service": "redis-exporter", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|ca04a12e16bef57e046cf970e459e5a67756f1a141cb895f5b52f13fe6296cef"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224309, "scanner": "repobility-docker", "fingerprint": "89d968a7ad4dcdd653e620e814b44c0c12ec68ff568a6c95b691930ea3e9ddb3", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "memcached-exporter", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|89d968a7ad4dcdd653e620e814b44c0c12ec68ff568a6c95b691930ea3e9ddb3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 224308, "scanner": "repobility-docker", "fingerprint": "42ab265c170c25b8a224a6680ae67f71fdc7a53bbb688448d010e2acb3cbb327", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "memcached-exporter", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|42ab265c170c25b8a224a6680ae67f71fdc7a53bbb688448d010e2acb3cbb327"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224305, "scanner": "repobility-docker", "fingerprint": "b66d7bf3d4f8bc744f5a105c8017f0ce1d71470ffcdf7c2abf21735a28ca2217", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "grafana", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|b66d7bf3d4f8bc744f5a105c8017f0ce1d71470ffcdf7c2abf21735a28ca2217"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224304, "scanner": "repobility-docker", "fingerprint": "b65cd3c8f5974b636f191966504ae554e647662e5a9da62296ec1fdc87841653", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "node-exporter", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|b65cd3c8f5974b636f191966504ae554e647662e5a9da62296ec1fdc87841653"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 224302, "scanner": "repobility-docker", "fingerprint": "9e4ff894d4e58005b49c2ec9aed45efd9ccc3dd42f25f6b2749a5345f5619869", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "node-exporter", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|9e4ff894d4e58005b49c2ec9aed45efd9ccc3dd42f25f6b2749a5345f5619869"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224300, "scanner": "repobility-docker", "fingerprint": "d5811a1b1e299f88dd47fdf1ae4423e3c5ae189c1bee905f6fcc30bb5f2bf22a", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "memcached", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|d5811a1b1e299f88dd47fdf1ae4423e3c5ae189c1bee905f6fcc30bb5f2bf22a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 224299, "scanner": "repobility-docker", "fingerprint": "270cab70a8a763881fdd6d7728ca33552fc518a36a7836e2f7ab8ea07698c950", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "memcached", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|270cab70a8a763881fdd6d7728ca33552fc518a36a7836e2f7ab8ea07698c950"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224296, "scanner": "repobility-docker", "fingerprint": "78aa1f8ee0a56c010c4114ced906df578457d6d3039a0d40834df3f61a7e99d8", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "prometheus", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|78aa1f8ee0a56c010c4114ced906df578457d6d3039a0d40834df3f61a7e99d8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 224295, "scanner": "repobility-docker", "fingerprint": "27ba65dd4e4b3c3268cdc7a50754f9b51e62e66bbcd6736407f7daecde3740e8", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "prometheus", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|27ba65dd4e4b3c3268cdc7a50754f9b51e62e66bbcd6736407f7daecde3740e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 224292, "scanner": "repobility-docker", "fingerprint": "8978a1297d1e2a776a07c7b7545f342a953cc2c275623f2d8b1104a5cb5a1b32", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "dragonfly", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|8978a1297d1e2a776a07c7b7545f342a953cc2c275623f2d8b1104a5cb5a1b32"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/docker/docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 224291, "scanner": "repobility-docker", "fingerprint": "bda9d1d7788d12829d67fb146a27b388605cf6f6ab534187e62dc65b58492857", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "dragonfly", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|bda9d1d7788d12829d67fb146a27b388605cf6f6ab534187e62dc65b58492857"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/docker/docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR008", "level": "note", "message": {"text": ".dockerignore misses sensitive defaults"}, "properties": {"repobilityId": 224283, "scanner": "repobility-docker", "fingerprint": "aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A Docker build context should exclude secrets and repository metadata.", "evidence": {"rule_id": "DKR008", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "missing_patterns": [".env", ".git", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC124", "level": "note", "message": {"text": "[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason."}, "properties": {"repobilityId": 224276, "scanner": "repobility-threat-engine", "fingerprint": "b8c71749028fc66493fa34d85d1d8bf1c4b98860ffc9997328f9313c88823613", "category": "race_condition", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "os.path.exists(path):\n            os.makedirs(path)\n\n        target = os.path.join(path, package.fil", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC124", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b8c71749028fc66493fa34d85d1d8bf1c4b98860ffc9997328f9313c88823613"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/osrepos/scripts/fetch-releases.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `encode_resp` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=1, for=2, if=1, nested_bonus=4, ternary=1."}, "properties": {"repobilityId": 224237, "scanner": "repobility-threat-engine", "fingerprint": "d092f21fa7b71c4961c9fa6d0e7e916ea43fdd1cbc2fe0338def524a47fa5897", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 9 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "encode_resp", "breakdown": {"if": 1, "for": 2, "ternary": 1, "continue": 1, "nested_bonus": 4}, "complexity": 9, "correlation_key": "fp|d092f21fa7b71c4961c9fa6d0e7e916ea43fdd1cbc2fe0338def524a47fa5897"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `typing-extensions` is minor version(s) behind (4.13.2 -> 4.15.0)"}, "properties": {"repobilityId": 224226, "scanner": "repobility-dependency-currency", "fingerprint": "5d389c78405ecb930b19c7587ee91ee7fe8976bf6c2ee5f6dc0fb723b1d8d9c1", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "typing-extensions", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "4.15.0", "correlation_key": "fp|5d389c78405ecb930b19c7587ee91ee7fe8976bf6c2ee5f6dc0fb723b1d8d9c1", "current_version": "4.13.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `tomli` is minor version(s) behind (2.2.1 -> 2.4.1)"}, "properties": {"repobilityId": 224225, "scanner": "repobility-dependency-currency", "fingerprint": "369b3c1901b4a584a4c8f8a4246bf06113814505fa189728ee3c707386cb2688", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "tomli", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.4.1", "correlation_key": "fp|369b3c1901b4a584a4c8f8a4246bf06113814505fa189728ee3c707386cb2688", "current_version": "2.2.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pytest-timeout` is minor version(s) behind (2.3.1 -> 2.4.0)"}, "properties": {"repobilityId": 224223, "scanner": "repobility-dependency-currency", "fingerprint": "fc7ee93a885e61cc6462dbedb4133a89d21c9c5015f0b0aa563bedd1fe6b2421", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest-timeout", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.4.0", "correlation_key": "fp|fc7ee93a885e61cc6462dbedb4133a89d21c9c5015f0b0aa563bedd1fe6b2421", "current_version": "2.3.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pytest-mock` is minor version(s) behind (3.14.0 -> 3.15.1)"}, "properties": {"repobilityId": 224222, "scanner": "repobility-dependency-currency", "fingerprint": "c10c0f87c509896c0db40861fbc01dc079b581284a8df76193145f785823e585", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest-mock", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "3.15.1", "correlation_key": "fp|c10c0f87c509896c0db40861fbc01dc079b581284a8df76193145f785823e585", "current_version": "3.14.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pytest-html` is minor version(s) behind (4.1.1 -> 4.2.0)"}, "properties": {"repobilityId": 224221, "scanner": "repobility-dependency-currency", "fingerprint": "90db49b59b317c526cf6f8be515035efd0f73a9d84bae1983be5adab3941cad4", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest-html", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "4.2.0", "correlation_key": "fp|90db49b59b317c526cf6f8be515035efd0f73a9d84bae1983be5adab3941cad4", "current_version": "4.1.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pytest-asyncio` is minor version(s) behind (1.3.0 -> 1.4.0)"}, "properties": {"repobilityId": 224219, "scanner": "repobility-dependency-currency", "fingerprint": "1b72dd4c86cb75c4cb3cba1a274c573bdfca264590f46f6f89c3e86370f46d7a", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest-asyncio", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "1.4.0", "correlation_key": "fp|1b72dd4c86cb75c4cb3cba1a274c573bdfca264590f46f6f89c3e86370f46d7a", "current_version": "1.3.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pytest` is minor version(s) behind (9.0.3 -> 9.1.0)"}, "properties": {"repobilityId": 224218, "scanner": "repobility-dependency-currency", "fingerprint": "c11b05fdac34d9b27ddc4a5560e83a40ff0794d0116a610865790a8c03574d0f", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pytest", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "9.1.0", "correlation_key": "fp|c11b05fdac34d9b27ddc4a5560e83a40ff0794d0116a610865790a8c03574d0f", "current_version": "9.0.3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pyprobables` is minor version(s) behind (0.6.1 -> 0.7.0)"}, "properties": {"repobilityId": 224217, "scanner": "repobility-dependency-currency", "fingerprint": "4bbeebeaeb26da491be3af427f178c61f0c82a7daedd129f9ff6e9dbe6a634b7", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pyprobables", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "0.7.0", "correlation_key": "fp|4bbeebeaeb26da491be3af427f178c61f0c82a7daedd129f9ff6e9dbe6a634b7", "current_version": "0.6.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pluggy` is minor version(s) behind (1.5.0 -> 1.6.0)"}, "properties": {"repobilityId": 224216, "scanner": "repobility-dependency-currency", "fingerprint": "e338ea9924dfb48e0051c79293a0156cd97f59ea899e2a90e6cf7440472d391e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pluggy", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "1.6.0", "correlation_key": "fp|e338ea9924dfb48e0051c79293a0156cd97f59ea899e2a90e6cf7440472d391e", "current_version": "1.5.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `lupa` is minor version(s) behind (2.4 -> 2.8)"}, "properties": {"repobilityId": 224213, "scanner": "repobility-dependency-currency", "fingerprint": "92b1f0cc8793559511e0f155f932fed314fbf8e205bf4a227d6bc49c558959fe", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "lupa", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.8", "correlation_key": "fp|92b1f0cc8793559511e0f155f932fed314fbf8e205bf4a227d6bc49c558959fe", "current_version": "2.4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `jsonpath-ng` is minor version(s) behind (1.7.0 -> 1.8.0)"}, "properties": {"repobilityId": 224212, "scanner": "repobility-dependency-currency", "fingerprint": "542846a0d9ebc483b62ad63bb807a79fdcf9700324dcd8f79892cec6b3ddf5ce", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "jsonpath-ng", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "1.8.0", "correlation_key": "fp|542846a0d9ebc483b62ad63bb807a79fdcf9700324dcd8f79892cec6b3ddf5ce", "current_version": "1.7.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `iniconfig` is minor version(s) behind (2.1.0 -> 2.3.0)"}, "properties": {"repobilityId": 224211, "scanner": "repobility-dependency-currency", "fingerprint": "56220fb12e1b5a50fe50e13388d1421054dcf2d7fa618189dd704ebaf490222d", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "iniconfig", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.3.0", "correlation_key": "fp|56220fb12e1b5a50fe50e13388d1421054dcf2d7fa618189dd704ebaf490222d", "current_version": "2.1.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `fakeredis` is minor version(s) behind (2.28.1 -> 2.36.1)"}, "properties": {"repobilityId": 224210, "scanner": "repobility-dependency-currency", "fingerprint": "59d2e6678de18310509c1ddc3e278c0b07d8a621e8627bd95460e7acae962f86", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "fakeredis", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.36.1", "correlation_key": "fp|59d2e6678de18310509c1ddc3e278c0b07d8a621e8627bd95460e7acae962f86", "current_version": "2.28.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `exceptiongroup` is minor version(s) behind (1.2.2 -> 1.3.1)"}, "properties": {"repobilityId": 224209, "scanner": "repobility-dependency-currency", "fingerprint": "159a252035b1f43f5ea13d81a1e38bc8254a44c10782d495ef42e14b9cb11d27", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "exceptiongroup", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "1.3.1", "correlation_key": "fp|159a252035b1f43f5ea13d81a1e38bc8254a44c10782d495ef42e14b9cb11d27", "current_version": "1.2.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `aiocsv` is minor version(s) behind (1.2.3 -> 1.4.1)"}, "properties": {"repobilityId": 224206, "scanner": "repobility-dependency-currency", "fingerprint": "1a92a49bebf1670f487a82facddf7abfe6620f5b260b6a1c6f0b0e34c129fb37", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "aiocsv", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "1.4.1", "correlation_key": "fp|1a92a49bebf1670f487a82facddf7abfe6620f5b260b6a1c6f0b0e34c129fb37", "current_version": "1.2.3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/requirements.txt"}, "region": {"startLine": 8}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "Workflow references `secrets.AZURE_STORAGE_CONNECTION_STRING` in a `pull_request` workflow"}, "properties": {"repobilityId": 224192, "scanner": "repobility-supply-chain", "fingerprint": "6f39c5555b5ed590707bc0ffd9144b3a0327f38fd08edc0a3fb082012d077d02", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|6f39c5555b5ed590707bc0ffd9144b3a0327f38fd08edc0a3fb082012d077d02"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 183}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "Workflow references `secrets.AZURE_REGTEST_CONTAINER` in a `pull_request` workflow"}, "properties": {"repobilityId": 224191, "scanner": "repobility-supply-chain", "fingerprint": "ac193e1473ef7de620a24bdf2e1d22f7b62eae3603116652d7f6c9cbfbd0f1eb", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ac193e1473ef7de620a24bdf2e1d22f7b62eae3603116652d7f6c9cbfbd0f1eb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 182}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "Workflow references `secrets.ANTHROPIC_API_KEY` in a `pull_request` workflow"}, "properties": {"repobilityId": 224187, "scanner": "repobility-supply-chain", "fingerprint": "b64d4e4b25f0dd5fe9c37fa1b551542c3a4ec650c57e0754035a7fbf990ab1b0", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b64d4e4b25f0dd5fe9c37fa1b551542c3a4ec650c57e0754035a7fbf990ab1b0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzz-pr.yml"}, "region": {"startLine": 137}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224186, "scanner": "repobility-supply-chain", "fingerprint": "369471b51f31a65d4a3f3cf6614a620edb03aa0e38f53d46c0ce63c65926cb63", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|369471b51f31a65d4a3f3cf6614a620edb03aa0e38f53d46c0ce63c65926cb63"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cov.yml"}, "region": {"startLine": 128}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224184, "scanner": "repobility-supply-chain", "fingerprint": "3370b12399f60ab0105439bf067f0a8e72452504f1fb8a4d7ebfae637a917710", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3370b12399f60ab0105439bf067f0a8e72452504f1fb8a4d7ebfae637a917710"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cov.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224183, "scanner": "repobility-supply-chain", "fingerprint": "ff232b14ad87a37fc6aa14ffd69a491e0efaa1f29940e9feb2703c74eeb7f9e9", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ff232b14ad87a37fc6aa14ffd69a491e0efaa1f29940e9feb2703c74eeb7f9e9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cov.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/cache` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 224182, "scanner": "repobility-supply-chain", "fingerprint": "ad24fb06b5b675bed8c992325255c143b881acd9c602cbf94b2438acfcd48b5b", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ad24fb06b5b675bed8c992325255c143b881acd9c602cbf94b2438acfcd48b5b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cov.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224181, "scanner": "repobility-supply-chain", "fingerprint": "d8dd8f1fa93f85af12fe51e10762e5afde789f5e2fe1e670a845b6740039bc06", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d8dd8f1fa93f85af12fe51e10762e5afde789f5e2fe1e670a845b6740039bc06"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cov.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224178, "scanner": "repobility-supply-chain", "fingerprint": "01dde92219071485498a49234a5cdeba06a3ddf47ee08e6a5074dae6b77122aa", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|01dde92219071485498a49234a5cdeba06a3ddf47ee08e6a5074dae6b77122aa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/epoll-regression-tests.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224177, "scanner": "repobility-supply-chain", "fingerprint": "7be226cd0c3298bdd2465d092d349602471c50196f59f869c97028d628f05e04", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7be226cd0c3298bdd2465d092d349602471c50196f59f869c97028d628f05e04"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/epoll-regression-tests.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224175, "scanner": "repobility-supply-chain", "fingerprint": "229ff9f2993ab27bbc483e503d2066ea1b364bf410b3a4de1ec6e09e0c6fd7cc", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|229ff9f2993ab27bbc483e503d2066ea1b364bf410b3a4de1ec6e09e0c6fd7cc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/epoll-regression-tests.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224174, "scanner": "repobility-supply-chain", "fingerprint": "7dfaea14d3d7acdc27b8926903e5c3b5da20513fda28e5583c0b0f21b93e088e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7dfaea14d3d7acdc27b8926903e5c3b5da20513fda28e5583c0b0f21b93e088e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/regression-tests.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224173, "scanner": "repobility-supply-chain", "fingerprint": "640bfc1024130c27d32f8bd14fed944403c40d2b29d309e23f5e3ab36bd25cac", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|640bfc1024130c27d32f8bd14fed944403c40d2b29d309e23f5e3ab36bd25cac"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/regression-tests.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224171, "scanner": "repobility-supply-chain", "fingerprint": "b4674e3c23414d79116915e7168d8a5ed727d248b0c12184ed7dc76c9e74da29", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b4674e3c23414d79116915e7168d8a5ed727d248b0c12184ed7dc76c9e74da29"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/regression-tests.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224169, "scanner": "repobility-supply-chain", "fingerprint": "af0de6fef489cf9bd5e7452e7ddd3b6c243bb1e9ce20644015509aadca8ded09", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|af0de6fef489cf9bd5e7452e7ddd3b6c243bb1e9ce20644015509aadca8ded09"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-builds.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224168, "scanner": "repobility-supply-chain", "fingerprint": "0bb17ecd723376eba9bc1ef0fe0aecef5e82864a53c7ad946d0713362cf5fffd", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0bb17ecd723376eba9bc1ef0fe0aecef5e82864a53c7ad946d0713362cf5fffd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-builds.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/deploy-pages` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 224166, "scanner": "repobility-supply-chain", "fingerprint": "778b7abec93ed1b1a4014e39aeade84af447b0f49458b519d22b99ec780fa6f2", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|778b7abec93ed1b1a4014e39aeade84af447b0f49458b519d22b99ec780fa6f2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-pages-artifact` pinned to mutable ref `@v5`"}, "properties": {"repobilityId": 224165, "scanner": "repobility-supply-chain", "fingerprint": "0e57deccda063b652c4038c6cb2a3da55bdd3c9784c3e3387e0d94270e8992cc", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0e57deccda063b652c4038c6cb2a3da55bdd3c9784c3e3387e0d94270e8992cc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/setup-python` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224164, "scanner": "repobility-supply-chain", "fingerprint": "7fc423b8c90c45950d6bd7dbe2d2eb671292a00b05d180b8944f399472539fa1", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7fc423b8c90c45950d6bd7dbe2d2eb671292a00b05d180b8944f399472539fa1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/download-artifact` pinned to mutable ref `@v8`"}, "properties": {"repobilityId": 224163, "scanner": "repobility-supply-chain", "fingerprint": "acfbf664970e036abb089f080fd2033d22393ad30d87012896c87a75d8d77412", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|acfbf664970e036abb089f080fd2033d22393ad30d87012896c87a75d8d77412"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 118}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact/merge` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224162, "scanner": "repobility-supply-chain", "fingerprint": "c1bb2ddb449399560aafc2d47f5d0b27e85ba9d27f4aecc46c47f95f854a558f", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c1bb2ddb449399560aafc2d47f5d0b27e85ba9d27f4aecc46c47f95f854a558f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224160, "scanner": "repobility-supply-chain", "fingerprint": "684040fc8bf575d963d04a62697e98299f5a9752950808071e09ef32f8fba67e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|684040fc8bf575d963d04a62697e98299f5a9752950808071e09ef32f8fba67e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/upload-artifact` pinned to mutable ref `@v7`"}, "properties": {"repobilityId": 224159, "scanner": "repobility-supply-chain", "fingerprint": "fa92b6aee388e44de57f1753ce66b1183ec0cdc73cb9d41ee1cb38e8dc567aca", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|fa92b6aee388e44de57f1753ce66b1183ec0cdc73cb9d41ee1cb38e8dc567aca"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v6`"}, "properties": {"repobilityId": 224158, "scanner": "repobility-supply-chain", "fingerprint": "3a34e6a824b70f02e3d8c24517a5ea8a77024cb6e8ed29a7850538ee48ba9982", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3a34e6a824b70f02e3d8c24517a5ea8a77024cb6e8ed29a7850538ee48ba9982"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "AIC009", "level": "note", "message": {"text": "Multiple AI-agent scaffold marker files are present"}, "properties": {"repobilityId": 224054, "scanner": "repobility-ai-code-hygiene", "fingerprint": "637be4b7d792540c9eb7ec6ecee111643252bb60385776703cb965bcde5506e0", "category": "quality", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository root contains several AI-agent scaffold marker files.", "evidence": {"markers": [".cursorrules", ".github/copilot-instructions.md", "AGENTS.md", "CLAUDE.md"], "rule_id": "AIC009", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|637be4b7d792540c9eb7ec6ecee111643252bb60385776703cb965bcde5506e0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursorrules"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED071", "level": "none", "message": {"text": "[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases."}, "properties": {"repobilityId": 224280, "scanner": "repobility-threat-engine", "fingerprint": "c955ddc58a4a30f6670eacc70460694303b9234785b976d1d742c5a8ccf6b889", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-panic-call", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348067+00:00", "triaged_in_corpus": 12, "observations_count": 29174, "ai_coder_pattern_id": 108}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c955ddc58a4a30f6670eacc70460694303b9234785b976d1d742c5a8ccf6b889"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/main.go"}, "region": {"startLine": 76}}}]}, {"ruleId": "MINED060", "level": "none", "message": {"text": "[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines."}, "properties": {"repobilityId": 224279, "scanner": "repobility-threat-engine", "fingerprint": "7000f5c098dc9e74263cfc4428cd714fbf0d2ca570609b4e6bddc7a7564fbab0", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-context-no-cancel", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348041+00:00", "triaged_in_corpus": 12, "observations_count": 132905, "ai_coder_pattern_id": 110}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7000f5c098dc9e74263cfc4428cd714fbf0d2ca570609b4e6bddc7a7564fbab0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/main.go"}, "region": {"startLine": 231}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 224277, "scanner": "repobility-threat-engine", "fingerprint": "28fbcff28232bb3fc528dcdba0664c2aaecbe85d1dae977272e1babf12de1399", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|28fbcff28232bb3fc528dcdba0664c2aaecbe85d1dae977272e1babf12de1399"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/osrepos/scripts/fetch-releases.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 224273, "scanner": "repobility-threat-engine", "fingerprint": "7272ab18ec48af8dc821b62a2c7121f16eb8db00d15f2adfeb9b81ca0b42c504", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7272ab18ec48af8dc821b62a2c7121f16eb8db00d15f2adfeb9b81ca0b42c504"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "SEC085", "level": "none", "message": {"text": "[SEC085] JS: child_process.exec with non-literal (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 224272, "scanner": "repobility-threat-engine", "fingerprint": "4434170c810fa43bf20566276ceaa9e55e65938a7f2140721f4fd2599ad87936", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|4434170c810fa43bf20566276ceaa9e55e65938a7f2140721f4fd2599ad87936"}}}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 224268, "scanner": "repobility-threat-engine", "fingerprint": "c59edcd8286991ab7caac4493f8f01b268fef2a5d218265ad20f6e2d1172fefb", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|c59edcd8286991ab7caac4493f8f01b268fef2a5d218265ad20f6e2d1172fefb"}}}, {"ruleId": "MINED053", "level": "none", "message": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "properties": {"repobilityId": 224264, "scanner": "repobility-threat-engine", "fingerprint": "154cff2782dad9d26c81475b4af3945d959988828eb2446b02e418aa5a7960dc", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "placeholder-default-username", "owasp": null, "cwe_ids": ["CWE-1392", "CWE-798"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348025+00:00", "triaged_in_corpus": 10, "observations_count": 456953, "ai_coder_pattern_id": 44}, "scanner": "repobility-threat-engine", "correlation_key": "fp|154cff2782dad9d26c81475b4af3945d959988828eb2446b02e418aa5a7960dc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/acl/user_registry.cc"}, "region": {"startLine": 33}}}]}, {"ruleId": "MINED053", "level": "none", "message": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "properties": {"repobilityId": 224263, "scanner": "repobility-threat-engine", "fingerprint": "531e24ae87eb1edaa75ed688e423425dfad026a6696611a85b2dbc232aabc27e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "placeholder-default-username", "owasp": null, "cwe_ids": ["CWE-1392", "CWE-798"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348025+00:00", "triaged_in_corpus": 10, "observations_count": 456953, "ai_coder_pattern_id": 44}, "scanner": "repobility-threat-engine", "correlation_key": "fp|531e24ae87eb1edaa75ed688e423425dfad026a6696611a85b2dbc232aabc27e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/acl/user.h"}, "region": {"startLine": 85}}}]}, {"ruleId": "MINED053", "level": "none", "message": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "properties": {"repobilityId": 224262, "scanner": "repobility-threat-engine", "fingerprint": "ba7a62757cdb244a630d56f61c138f100e193612d31ce7839172ec886e77a5b3", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "placeholder-default-username", "owasp": null, "cwe_ids": ["CWE-1392", "CWE-798"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348025+00:00", "triaged_in_corpus": 10, "observations_count": 456953, "ai_coder_pattern_id": 44}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ba7a62757cdb244a630d56f61c138f100e193612d31ce7839172ec886e77a5b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/acl/user.cc"}, "region": {"startLine": 151}}}]}, {"ruleId": "MINED075", "level": "none", "message": {"text": "[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL."}, "properties": {"repobilityId": 224261, "scanner": "repobility-threat-engine", "fingerprint": "e9d725af67aeb522af30b544e153c8ce4cc5183940ee617ac5a16aa3695d51f7", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "c-malloc-no-check", "owasp": null, "cwe_ids": ["CWE-690"], "languages": ["c", "cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348076+00:00", "triaged_in_corpus": 12, "observations_count": 11735, "ai_coder_pattern_id": 131}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e9d725af67aeb522af30b544e153c8ce4cc5183940ee617ac5a16aa3695d51f7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/redis/lua/cjson/strbuf.c"}, "region": {"startLine": 61}}}]}, {"ruleId": "MINED075", "level": "none", "message": {"text": "[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL."}, "properties": {"repobilityId": 224260, "scanner": "repobility-threat-engine", "fingerprint": "41b572a2bbc70a24e61fb51fab2c61d71d149cba2a0cd00c95228132f941b26f", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "c-malloc-no-check", "owasp": null, "cwe_ids": ["CWE-690"], "languages": ["c", "cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348076+00:00", "triaged_in_corpus": 12, "observations_count": 11735, "ai_coder_pattern_id": 131}, "scanner": "repobility-threat-engine", "correlation_key": "fp|41b572a2bbc70a24e61fb51fab2c61d71d149cba2a0cd00c95228132f941b26f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/redis/lua/cjson/fpconv.c"}, "region": {"startLine": 127}}}]}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 224258, "scanner": "repobility-threat-engine", "fingerprint": "0b38375b078c8418d6307aa9c570040a9643ba3a5d7e1f025acbe797cc3bdc28", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|0b38375b078c8418d6307aa9c570040a9643ba3a5d7e1f025acbe797cc3bdc28", "aggregated_count": 5}}}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "properties": {"repobilityId": 224257, "scanner": "repobility-threat-engine", "fingerprint": "7492ea44121261b472c85efcf1d75a734a04c9b22ffc443605afa9dd45b78cc7", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7492ea44121261b472c85efcf1d75a734a04c9b22ffc443605afa9dd45b78cc7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/facade/resp_validator.cc"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "properties": {"repobilityId": 224256, "scanner": "repobility-threat-engine", "fingerprint": "f698390d87a067b02af978b1fcdbea868302567900fdc57327d1ed7226a188ea", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f698390d87a067b02af978b1fcdbea868302567900fdc57327d1ed7226a188ea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/small_string.cc"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "properties": {"repobilityId": 224255, "scanner": "repobility-threat-engine", "fingerprint": "8d358cbf58497a25149472e39df31b01ba0fee2e845df7c797327d23ec2fa9f4", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8d358cbf58497a25149472e39df31b01ba0fee2e845df7c797327d23ec2fa9f4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/score_map_test.cc"}, "region": {"startLine": 48}}}]}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 224254, "scanner": "repobility-threat-engine", "fingerprint": "8a77ffb0a8fcdda223aabe32cdaf0e5bdc6cae13db4c9684d2f2d4932a1285a8", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|8a77ffb0a8fcdda223aabe32cdaf0e5bdc6cae13db4c9684d2f2d4932a1285a8"}}}, {"ruleId": "MINED022", "level": "none", "message": {"text": "[MINED022] C Strcpy (and 38 more): Same pattern found in 38 additional files. Review if needed."}, "properties": {"repobilityId": 224250, "scanner": "repobility-threat-engine", "fingerprint": "faccbed4caf58dd6a99c3bd6f7233b2d95dccec01ad02fc9fa5332b6c38e528d", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 38 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "c-strcpy", "owasp": null, "cwe_ids": ["CWE-120"], "languages": ["c", "cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347949+00:00", "triaged_in_corpus": 20, "observations_count": 39114, "ai_coder_pattern_id": 130}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|faccbed4caf58dd6a99c3bd6f7233b2d95dccec01ad02fc9fa5332b6c38e528d", "aggregated_count": 38}}}, {"ruleId": "MINED080", "level": "none", "message": {"text": "[MINED080] Cpp Using Namespace Std (and 89 more): Same pattern found in 89 additional files. Review if needed."}, "properties": {"repobilityId": 224246, "scanner": "repobility-threat-engine", "fingerprint": "7ac35cc5050c639d4ee46f61d857dc582ef467106afeed0d37b433bc5a8f922f", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 89 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "cpp-using-namespace-std", "owasp": null, "cwe_ids": [], "languages": ["cpp", "h", "hpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348123+00:00", "triaged_in_corpus": 12, "observations_count": 3566, "ai_coder_pattern_id": 133}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|7ac35cc5050c639d4ee46f61d857dc582ef467106afeed0d37b433bc5a8f922f", "aggregated_count": 89}}}, {"ruleId": "MINED080", "level": "none", "message": {"text": "[MINED080] Cpp Using Namespace Std: using namespace std; pollutes the global namespace."}, "properties": {"repobilityId": 224245, "scanner": "repobility-threat-engine", "fingerprint": "9fa5548a8d7a830fd0e603f7351f6336f9c5bcd511f584cc94fe9c8509796c11", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-using-namespace-std", "owasp": null, "cwe_ids": [], "languages": ["cpp", "h", "hpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348123+00:00", "triaged_in_corpus": 12, "observations_count": 3566, "ai_coder_pattern_id": 133}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9fa5548a8d7a830fd0e603f7351f6336f9c5bcd511f584cc94fe9c8509796c11"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/cms_test.cc"}, "region": {"startLine": 15}}}]}, {"ruleId": "MINED080", "level": "none", "message": {"text": "[MINED080] Cpp Using Namespace Std: using namespace std; pollutes the global namespace."}, "properties": {"repobilityId": 224244, "scanner": "repobility-threat-engine", "fingerprint": "75f7b23d2e5936ac6678c6b0303d8b0d9f0c8a2fce72178acdbf6cc5ee32af11", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-using-namespace-std", "owasp": null, "cwe_ids": [], "languages": ["cpp", "h", "hpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348123+00:00", "triaged_in_corpus": 12, "observations_count": 3566, "ai_coder_pattern_id": 133}, "scanner": "repobility-threat-engine", "correlation_key": "fp|75f7b23d2e5936ac6678c6b0303d8b0d9f0c8a2fce72178acdbf6cc5ee32af11"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/bloom_test.cc"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED080", "level": "none", "message": {"text": "[MINED080] Cpp Using Namespace Std: using namespace std; pollutes the global namespace."}, "properties": {"repobilityId": 224243, "scanner": "repobility-threat-engine", "fingerprint": "2e8cc268731af0c74cc4035bfb675082944e7b7614bf57f6a3af980ac34335b5", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-using-namespace-std", "owasp": null, "cwe_ids": [], "languages": ["cpp", "h", "hpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348123+00:00", "triaged_in_corpus": 12, "observations_count": 3566, "ai_coder_pattern_id": 133}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2e8cc268731af0c74cc4035bfb675082944e7b7614bf57f6a3af980ac34335b5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/allocation_tracker_test.cc"}, "region": {"startLine": 20}}}]}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 11 more): Same pattern found in 11 additional files. Review if needed."}, "properties": {"repobilityId": 224239, "scanner": "repobility-threat-engine", "fingerprint": "8d1502acd42cce6119d839e48acbcfd7f61fd37700295976e1fa3a0ac15210ab", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 11 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "main", "breakdown": {"if": 12, "or": 2, "for": 2, "else": 1, "except": 1, "continue": 3, "nested_bonus": 7}, "aggregated": true, "complexity": 28, "correlation_key": "fp|8d1502acd42cce6119d839e48acbcfd7f61fd37700295976e1fa3a0ac15210ab", "aggregated_count": 11}}}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 224235, "scanner": "repobility-threat-engine", "fingerprint": "9c6b95396e2a5b42c2068558889d2e22771a41dba9c87f488821b89c471c0d6d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9c6b95396e2a5b42c2068558889d2e22771a41dba9c87f488821b89c471c0d6d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/replay_crash.py"}, "region": {"startLine": 37}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 224234, "scanner": "repobility-threat-engine", "fingerprint": "9948fe346b9ceb43e94edc0a0cd684878a89f10683d94c33e5f4c2f0c940f569", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9948fe346b9ceb43e94edc0a0cd684878a89f10683d94c33e5f4c2f0c940f569"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/memcache_mutator.py"}, "region": {"startLine": 209}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 224233, "scanner": "repobility-threat-engine", "fingerprint": "a3ffda9e727af8063977aaa6a61b5ed21c83653214ac9033d5241a7c173c9ac5", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a3ffda9e727af8063977aaa6a61b5ed21c83653214ac9033d5241a7c173c9ac5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 192}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 224232, "scanner": "repobility-threat-engine", "fingerprint": "92481ff7b2ccbc145e46eda9b65285b95b11bac25ff91203d752a2409d0a28d3", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|92481ff7b2ccbc145e46eda9b65285b95b11bac25ff91203d752a2409d0a28d3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 249}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 224228, "scanner": "repobility-threat-engine", "fingerprint": "2c95d3544370d7ecd4046678ce9ed658064989e0a5b541aa92225267b709d9bc", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "print(\"No ANTHROPIC_API_KEY set, skipping seed generation\", file=sys.stderr)", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|24|print no anthropic_api_key set skipping seed generation file sys.stderr"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 249}}}]}, {"ruleId": "DEPCUR-PY", "level": "none", "message": {"text": "Python package `markupsafe` is patch version(s) behind (3.0.2 -> 3.0.3)"}, "properties": {"repobilityId": 224214, "scanner": "repobility-dependency-currency", "fingerprint": "bdea9ab416d6f48ca32a33a36383f77e637e717c5619aba4fc25b291722216bd", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "markupsafe", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "3.0.3", "correlation_key": "fp|bdea9ab416d6f48ca32a33a36383f77e637e717c5619aba4fc25b291722216bd", "current_version": "3.0.2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-PY", "level": "none", "message": {"text": "Python package `PyYAML` is patch version(s) behind (6.0 -> 6.0.3)"}, "properties": {"repobilityId": 224204, "scanner": "repobility-dependency-currency", "fingerprint": "b8e358079985bb72d4b3a95b9e2b6e528627cbe9e531557632dd43148a22df2c", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "PyYAML", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "6.0.3", "correlation_key": "fp|b8e358079985bb72d4b3a95b9e2b6e528627cbe9e531557632dd43148a22df2c", "current_version": "6.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/requirements.txt"}, "region": {"startLine": 4}}}]}, {"ruleId": "GO-2026-5039", "level": "error", "message": {"text": "stdlib: GO-2026-5039"}, "properties": {"repobilityId": 224590, "scanner": "osv-scanner", "fingerprint": "4978700dcb26d398ec932a956bb03315d038b07f0b1db14b48e6ba67fde88111", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42507", "CVE-2026-42507"], "package": "stdlib", "rule_id": "GO-2026-5039", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42507|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5038", "level": "error", "message": {"text": "stdlib: GO-2026-5038"}, "properties": {"repobilityId": 224584, "scanner": "osv-scanner", "fingerprint": "e2bddb8bbfa702c41767386b310355cf5bc550208b90e753bbbe82ca329b3c8b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42504", "CVE-2026-42504"], "package": "stdlib", "rule_id": "GO-2026-5038", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42504|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5037", "level": "error", "message": {"text": "stdlib: GO-2026-5037"}, "properties": {"repobilityId": 224582, "scanner": "osv-scanner", "fingerprint": "fb6ba8ed9c0d2fa17b7458d52e9331cd55fee0c5cf87ce4d1971332e1ab2e18f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27145", "CVE-2026-27145"], "package": "stdlib", "rule_id": "GO-2026-5037", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27145|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4986", "level": "error", "message": {"text": "stdlib: GO-2026-4986"}, "properties": {"repobilityId": 224576, "scanner": "osv-scanner", "fingerprint": "a18199d13b5d578ea834a15aeb02e9e9fb26f6cf11175920741906e546e1870f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39820", "CVE-2026-39820"], "package": "stdlib", "rule_id": "GO-2026-4986", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39820|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4982", "level": "error", "message": {"text": "stdlib: GO-2026-4982"}, "properties": {"repobilityId": 224574, "scanner": "osv-scanner", "fingerprint": "3354f0ceb8bbc339d55154b8ca8a4e381e855e98cab0f4b3b2509bc7f2c3ee00", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39823", "CVE-2026-39823"], "package": "stdlib", "rule_id": "GO-2026-4982", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39823|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4981", "level": "error", "message": {"text": "stdlib: GO-2026-4981"}, "properties": {"repobilityId": 224573, "scanner": "osv-scanner", "fingerprint": "b4ebad0a0e15dd72bfc3b0d41c3ed4d1dc1557885abe4b0a6ff9f6a64f9610e0", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33811", "CVE-2026-33811"], "package": "stdlib", "rule_id": "GO-2026-4981", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-33811|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4980", "level": "error", "message": {"text": "stdlib: GO-2026-4980"}, "properties": {"repobilityId": 224570, "scanner": "osv-scanner", "fingerprint": "7c7fb15236e7edaaa17a7c3857056aeedd8c578cb5e75d029c131e6fb7cb0843", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39826", "CVE-2026-39826"], "package": "stdlib", "rule_id": "GO-2026-4980", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39826|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4977", "level": "error", "message": {"text": "stdlib: GO-2026-4977"}, "properties": {"repobilityId": 224568, "scanner": "osv-scanner", "fingerprint": "8a04f7dac00b54a038b168bb8836a029a5d3789ff067a19f29a688fe4d07c3a1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42499", "CVE-2026-42499"], "package": "stdlib", "rule_id": "GO-2026-4977", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42499|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4976", "level": "error", "message": {"text": "stdlib: GO-2026-4976"}, "properties": {"repobilityId": 224567, "scanner": "osv-scanner", "fingerprint": "e83562305fbde457dfe7a2aeb13ba24364f2bba4dd25afb3091cc59a000d5dc1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39825", "CVE-2026-39825"], "package": "stdlib", "rule_id": "GO-2026-4976", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39825|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4971", "level": "error", "message": {"text": "stdlib: GO-2026-4971"}, "properties": {"repobilityId": 224566, "scanner": "osv-scanner", "fingerprint": "3721062a882c94c50e7d9b3617b7ce1193ef98e883eded7fe5ca7460283df623", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39836", "CVE-2026-39836"], "package": "stdlib", "rule_id": "GO-2026-4971", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39836|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4947", "level": "error", "message": {"text": "stdlib: GO-2026-4947"}, "properties": {"repobilityId": 224564, "scanner": "osv-scanner", "fingerprint": "8d4adaf3bc5c50fcf57c9289441e18635befe43e48e7dc96b8dad4d63fbb81c2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32280", "CVE-2026-32280"], "package": "stdlib", "rule_id": "GO-2026-4947", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32280|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4946", "level": "error", "message": {"text": "stdlib: GO-2026-4946"}, "properties": {"repobilityId": 224563, "scanner": "osv-scanner", "fingerprint": "5327900071de61ec08a4954034983b965eca0430f424ec6240d06b088e7d0941", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32281", "CVE-2026-32281"], "package": "stdlib", "rule_id": "GO-2026-4946", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32281|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4918", "level": "error", "message": {"text": "stdlib: GO-2026-4918"}, "properties": {"repobilityId": 224561, "scanner": "osv-scanner", "fingerprint": "87092c7aafc07ec12bdf48aac1ae3653be74cda3cfcb49f45b0660f2e48d09e9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33814", "CVE-2026-33814"], "package": "stdlib", "rule_id": "GO-2026-4918", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-33814|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4870", "level": "error", "message": {"text": "stdlib: GO-2026-4870"}, "properties": {"repobilityId": 224560, "scanner": "osv-scanner", "fingerprint": "abbb120a3310e8984df7e584581e4a451639f3136bb9e1e448cad3a287533cff", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32283", "CVE-2026-32283"], "package": "stdlib", "rule_id": "GO-2026-4870", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32283|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4869", "level": "error", "message": {"text": "stdlib: GO-2026-4869"}, "properties": {"repobilityId": 224555, "scanner": "osv-scanner", "fingerprint": "0de878d0d0a99eec0fe24c960c9480078ac92adb3d66f7d3ad26c29393b99483", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32288", "CVE-2026-32288"], "package": "stdlib", "rule_id": "GO-2026-4869", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32288|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4865", "level": "error", "message": {"text": "stdlib: GO-2026-4865"}, "properties": {"repobilityId": 224553, "scanner": "osv-scanner", "fingerprint": "4b1ef5c035297e7abe7d2e9f69527c28019f7e2cb31e9088235f53865aca090e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32289", "CVE-2026-32289"], "package": "stdlib", "rule_id": "GO-2026-4865", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32289|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4864", "level": "error", "message": {"text": "stdlib: GO-2026-4864"}, "properties": {"repobilityId": 224552, "scanner": "osv-scanner", "fingerprint": "fa54b30683e656d97f39693231eec4ce1eb197e57bf1251ac43f66bf15c8a831", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32282", "CVE-2026-32282"], "package": "stdlib", "rule_id": "GO-2026-4864", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32282|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4603", "level": "error", "message": {"text": "stdlib: GO-2026-4603"}, "properties": {"repobilityId": 224550, "scanner": "osv-scanner", "fingerprint": "1c8b6d4ab85f215a044c5b068b8870411683d98c93ce04a7e3f8d0e7180e6230", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27142", "CVE-2026-27142"], "package": "stdlib", "rule_id": "GO-2026-4603", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27142|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4602", "level": "error", "message": {"text": "stdlib: GO-2026-4602"}, "properties": {"repobilityId": 224546, "scanner": "osv-scanner", "fingerprint": "702cf4ac3f5d9942692b0f17c9f64f9d2cd0d39541f828f7bea35a1e81824acf", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27139", "CVE-2026-27139"], "package": "stdlib", "rule_id": "GO-2026-4602", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27139|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4601", "level": "error", "message": {"text": "stdlib: GO-2026-4601"}, "properties": {"repobilityId": 224544, "scanner": "osv-scanner", "fingerprint": "3601221877ff420c9bdaf4b0eaa8b65e01e5566fad04de3337053342e4cd1f2d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-25679", "CVE-2026-25679"], "package": "stdlib", "rule_id": "GO-2026-4601", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-25679|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4342", "level": "error", "message": {"text": "stdlib: GO-2026-4342"}, "properties": {"repobilityId": 224541, "scanner": "osv-scanner", "fingerprint": "9649d3c0f47f6c10b94e51883f499f7f26467fd025e4334c26aab6fe11834322", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61728", "CVE-2025-61728"], "package": "stdlib", "rule_id": "GO-2026-4342", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61728|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4341", "level": "error", "message": {"text": "stdlib: GO-2026-4341"}, "properties": {"repobilityId": 224539, "scanner": "osv-scanner", "fingerprint": "32955e28dd777d04418b37712bf265cdfbe08c54c375c03ff19c960837843bc7", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61726", "CVE-2025-61726"], "package": "stdlib", "rule_id": "GO-2026-4341", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61726|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4340", "level": "error", "message": {"text": "stdlib: GO-2026-4340"}, "properties": {"repobilityId": 224538, "scanner": "osv-scanner", "fingerprint": "bc22542c3cd3362f849e811c21bd7f03f280ec3362154718c0ec831f6bd8d8c9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61730", "CVE-2025-61730"], "package": "stdlib", "rule_id": "GO-2026-4340", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61730|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4337", "level": "error", "message": {"text": "stdlib: GO-2026-4337"}, "properties": {"repobilityId": 224537, "scanner": "osv-scanner", "fingerprint": "154a1069982e76313f09fa007e1770c7ee4c25a1b5d6583bb0dc2e2f512c1620", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-68121", "CVE-2025-68121"], "package": "stdlib", "rule_id": "GO-2026-4337", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-68121|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4175", "level": "error", "message": {"text": "stdlib: GO-2025-4175"}, "properties": {"repobilityId": 224536, "scanner": "osv-scanner", "fingerprint": "d0996e989380c61fa135f65d08f343d799a90d9e1aa4215366e55285b2e6d72a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61727", "CVE-2025-61727"], "package": "stdlib", "rule_id": "GO-2025-4175", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61727|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4155", "level": "error", "message": {"text": "stdlib: GO-2025-4155"}, "properties": {"repobilityId": 224535, "scanner": "osv-scanner", "fingerprint": "0212c843bd1d28d4bc10524dd201ff981500e600911d76a77ea031101093ff01", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61729", "CVE-2025-61729"], "package": "stdlib", "rule_id": "GO-2025-4155", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61729|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4015", "level": "error", "message": {"text": "stdlib: GO-2025-4015"}, "properties": {"repobilityId": 224534, "scanner": "osv-scanner", "fingerprint": "beeb8991bf3fa1c9a8eaae0f003acccb57159363be4a96ddc7fe2549497740c5", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61724", "CVE-2025-61724"], "package": "stdlib", "rule_id": "GO-2025-4015", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61724|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4014", "level": "error", "message": {"text": "stdlib: GO-2025-4014"}, "properties": {"repobilityId": 224533, "scanner": "osv-scanner", "fingerprint": "cbec6e401c47e0498023f9b0547e99d62de2c98ed97085e43916c6c51b770e7a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58183", "CVE-2025-58183"], "package": "stdlib", "rule_id": "GO-2025-4014", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58183|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4013", "level": "error", "message": {"text": "stdlib: GO-2025-4013"}, "properties": {"repobilityId": 224532, "scanner": "osv-scanner", "fingerprint": "cbc8a7437b5f020c83d709e73919429504d63210d95cae2383f83a0a2281bbc2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58188", "CVE-2025-58188"], "package": "stdlib", "rule_id": "GO-2025-4013", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58188|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4012", "level": "error", "message": {"text": "stdlib: GO-2025-4012"}, "properties": {"repobilityId": 224531, "scanner": "osv-scanner", "fingerprint": "32ec3e40ca07c71ee797ec06704e0538d407422c156ea4e55ae65e6184177830", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58186", "CVE-2025-58186"], "package": "stdlib", "rule_id": "GO-2025-4012", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58186|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4011", "level": "error", "message": {"text": "stdlib: GO-2025-4011"}, "properties": {"repobilityId": 224525, "scanner": "osv-scanner", "fingerprint": "a37584aba7918762681191911542838f31e17f6ad94ea545ccf6c9c76fd62528", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58185", "CVE-2025-58185"], "package": "stdlib", "rule_id": "GO-2025-4011", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58185|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4010", "level": "error", "message": {"text": "stdlib: GO-2025-4010"}, "properties": {"repobilityId": 224524, "scanner": "osv-scanner", "fingerprint": "5b7ca345e6ce9c9991429bc84cf4632b99517d53fe5123143c7506727678c9d0", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47912", "CVE-2025-47912"], "package": "stdlib", "rule_id": "GO-2025-4010", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47912|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4009", "level": "error", "message": {"text": "stdlib: GO-2025-4009"}, "properties": {"repobilityId": 224523, "scanner": "osv-scanner", "fingerprint": "9252ab95744012cf0ce042178c0e3aac41b3eb1b25ae76433b98c4409d1eb388", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61723", "CVE-2025-61723"], "package": "stdlib", "rule_id": "GO-2025-4009", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61723|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4008", "level": "error", "message": {"text": "stdlib: GO-2025-4008"}, "properties": {"repobilityId": 224521, "scanner": "osv-scanner", "fingerprint": "3b0dd39783c42fd9e6c53546693ed4e2763372be58bf38ba770bf920a07bc148", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58189", "CVE-2025-58189"], "package": "stdlib", "rule_id": "GO-2025-4008", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58189|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4007", "level": "error", "message": {"text": "stdlib: GO-2025-4007"}, "properties": {"repobilityId": 224520, "scanner": "osv-scanner", "fingerprint": "972749a05d9ced05359bd3801f93338af1ab1ac7ab3ddc1aadf1bb7e7c59b2b0", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58187", "CVE-2025-58187"], "package": "stdlib", "rule_id": "GO-2025-4007", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58187|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4006", "level": "error", "message": {"text": "stdlib: GO-2025-4006"}, "properties": {"repobilityId": 224515, "scanner": "osv-scanner", "fingerprint": "247891d33308bb1c10338efa1f7e210e5b834abee2064733b8a75ef56cf436f6", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61725", "CVE-2025-61725"], "package": "stdlib", "rule_id": "GO-2025-4006", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61725|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3956", "level": "error", "message": {"text": "stdlib: GO-2025-3956"}, "properties": {"repobilityId": 224512, "scanner": "osv-scanner", "fingerprint": "d62d7bd370b4ee53195e9a5943407bd78df771e5ec20f6f833afe52c7b6314b4", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47906", "CVE-2025-47906"], "package": "stdlib", "rule_id": "GO-2025-3956", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47906|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3849", "level": "error", "message": {"text": "stdlib: GO-2025-3849"}, "properties": {"repobilityId": 224511, "scanner": "osv-scanner", "fingerprint": "abf4cdc23981106d3a8d812c9bcf25d0fb3028860a2f5232538c2dc3cb168877", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47907", "CVE-2025-47907"], "package": "stdlib", "rule_id": "GO-2025-3849", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47907|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5024", "level": "error", "message": {"text": "golang.org/x/sys: GO-2026-5024"}, "properties": {"repobilityId": 224509, "scanner": "osv-scanner", "fingerprint": "f8cf5c0c0c0ea5815834e422729bc365b9c23fc8b1b8f8ebb523e35b3d2ec99f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39824"], "package": "golang.org/x/sys", "rule_id": "GO-2026-5024", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/sys|CVE-2026-39824|tools/vector-benches/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5039", "level": "error", "message": {"text": "stdlib: GO-2026-5039"}, "properties": {"repobilityId": 224504, "scanner": "osv-scanner", "fingerprint": "87fdd16982264eec13c17c78d8512a4baae56e08345fac103733f22f1cfa6c8d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42507", "CVE-2026-42507"], "package": "stdlib", "rule_id": "GO-2026-5039", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42507|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5038", "level": "error", "message": {"text": "stdlib: GO-2026-5038"}, "properties": {"repobilityId": 224500, "scanner": "osv-scanner", "fingerprint": "5646128c7f0da562521050bbbba61d94d07c1cac5d0c4b0bebf84c2d8e8955c7", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42504", "CVE-2026-42504"], "package": "stdlib", "rule_id": "GO-2026-5038", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42504|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5037", "level": "error", "message": {"text": "stdlib: GO-2026-5037"}, "properties": {"repobilityId": 224499, "scanner": "osv-scanner", "fingerprint": "12f2f5b2f4bbd24e7b3f7006a93cfa90929136202e8a29d26ea1eee33d44cb14", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27145", "CVE-2026-27145"], "package": "stdlib", "rule_id": "GO-2026-5037", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27145|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4986", "level": "error", "message": {"text": "stdlib: GO-2026-4986"}, "properties": {"repobilityId": 224495, "scanner": "osv-scanner", "fingerprint": "c3d06a09ec96882f50fd5727a5cdf792262a8c478754d65555ce843c0c499e9f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39820", "CVE-2026-39820"], "package": "stdlib", "rule_id": "GO-2026-4986", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39820|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4982", "level": "error", "message": {"text": "stdlib: GO-2026-4982"}, "properties": {"repobilityId": 224494, "scanner": "osv-scanner", "fingerprint": "9ea1787736387570beb2892e206e1d7caabbde2baa299848f76daa8112936a92", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39823", "CVE-2026-39823"], "package": "stdlib", "rule_id": "GO-2026-4982", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39823|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4981", "level": "error", "message": {"text": "stdlib: GO-2026-4981"}, "properties": {"repobilityId": 224493, "scanner": "osv-scanner", "fingerprint": "e61b805b263aaa6ddc34043c270832cd939999a7455d73a44607a0d83b8ab336", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33811", "CVE-2026-33811"], "package": "stdlib", "rule_id": "GO-2026-4981", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-33811|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4980", "level": "error", "message": {"text": "stdlib: GO-2026-4980"}, "properties": {"repobilityId": 224492, "scanner": "osv-scanner", "fingerprint": "dc8d592c25e6064e89d35a20158987bb4f82b8bfa65190c54eb67b16a5157e44", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39826", "CVE-2026-39826"], "package": "stdlib", "rule_id": "GO-2026-4980", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39826|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4977", "level": "error", "message": {"text": "stdlib: GO-2026-4977"}, "properties": {"repobilityId": 224489, "scanner": "osv-scanner", "fingerprint": "069081be2ad32af368df7014c081d587b389e5056ef48cecd489b7db726b3887", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42499", "CVE-2026-42499"], "package": "stdlib", "rule_id": "GO-2026-4977", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42499|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4976", "level": "error", "message": {"text": "stdlib: GO-2026-4976"}, "properties": {"repobilityId": 224487, "scanner": "osv-scanner", "fingerprint": "7ac7afcea01498329f9f848eb31d94d05b38b53edfbec469138ea14a2a232580", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39825", "CVE-2026-39825"], "package": "stdlib", "rule_id": "GO-2026-4976", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39825|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4971", "level": "error", "message": {"text": "stdlib: GO-2026-4971"}, "properties": {"repobilityId": 224486, "scanner": "osv-scanner", "fingerprint": "de1aa61e3e4b092d72b7ed4c39ad6e01b9b6f337051c9f778fbc547c823d72c9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39836", "CVE-2026-39836"], "package": "stdlib", "rule_id": "GO-2026-4971", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39836|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4947", "level": "error", "message": {"text": "stdlib: GO-2026-4947"}, "properties": {"repobilityId": 224485, "scanner": "osv-scanner", "fingerprint": "2159b613dffd6f8f08c57a0b593d0fa3d32a927f28e1b7b2f5f13e4c8f59e3d9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32280", "CVE-2026-32280"], "package": "stdlib", "rule_id": "GO-2026-4947", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32280|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4946", "level": "error", "message": {"text": "stdlib: GO-2026-4946"}, "properties": {"repobilityId": 224481, "scanner": "osv-scanner", "fingerprint": "ab51fb191262b7d12695d6a7c2a112c2abd8f56a0e18a1e1501e41432d1bba3c", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32281", "CVE-2026-32281"], "package": "stdlib", "rule_id": "GO-2026-4946", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32281|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4918", "level": "error", "message": {"text": "stdlib: GO-2026-4918"}, "properties": {"repobilityId": 224479, "scanner": "osv-scanner", "fingerprint": "c755623aa386248422546e92db17a9b8e9992bf881c29d12a4fc2896b2ef3f81", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33814", "CVE-2026-33814"], "package": "stdlib", "rule_id": "GO-2026-4918", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-33814|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4870", "level": "error", "message": {"text": "stdlib: GO-2026-4870"}, "properties": {"repobilityId": 224476, "scanner": "osv-scanner", "fingerprint": "202ae369acafc43eabc06b6b8dfd8e9dd4461e400d523aa0f271f63ead69d961", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32283", "CVE-2026-32283"], "package": "stdlib", "rule_id": "GO-2026-4870", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32283|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4869", "level": "error", "message": {"text": "stdlib: GO-2026-4869"}, "properties": {"repobilityId": 224475, "scanner": "osv-scanner", "fingerprint": "1880772ebf589c6f5e1868537605c4fbc9ee79f88d83c587104909ec47b5ea2b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32288", "CVE-2026-32288"], "package": "stdlib", "rule_id": "GO-2026-4869", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32288|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4865", "level": "error", "message": {"text": "stdlib: GO-2026-4865"}, "properties": {"repobilityId": 224474, "scanner": "osv-scanner", "fingerprint": "a774ea56f716e33db6df841806ad11a362a56431c79c82768dff46075502c91d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32289", "CVE-2026-32289"], "package": "stdlib", "rule_id": "GO-2026-4865", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32289|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4864", "level": "error", "message": {"text": "stdlib: GO-2026-4864"}, "properties": {"repobilityId": 224469, "scanner": "osv-scanner", "fingerprint": "7d0e544bb896300ad8c140023d35fd2b861e95b38c0171be3e4ddf6f2cac0891", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32282", "CVE-2026-32282"], "package": "stdlib", "rule_id": "GO-2026-4864", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32282|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4603", "level": "error", "message": {"text": "stdlib: GO-2026-4603"}, "properties": {"repobilityId": 224466, "scanner": "osv-scanner", "fingerprint": "dde7f86787eabea44acea7ff886ef0963028ed6af9de060bbe9d9406008c0af1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27142", "CVE-2026-27142"], "package": "stdlib", "rule_id": "GO-2026-4603", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27142|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4602", "level": "error", "message": {"text": "stdlib: GO-2026-4602"}, "properties": {"repobilityId": 224463, "scanner": "osv-scanner", "fingerprint": "559403ce9834459dc071fdecd78c2b34520538fec9e7bd4a90f8c5fabb4c294a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27139", "CVE-2026-27139"], "package": "stdlib", "rule_id": "GO-2026-4602", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27139|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4601", "level": "error", "message": {"text": "stdlib: GO-2026-4601"}, "properties": {"repobilityId": 224461, "scanner": "osv-scanner", "fingerprint": "4568e5715f8ff9502a8ebeb0091a06c771fc176092fc0c78237fa731bd307e7d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-25679", "CVE-2026-25679"], "package": "stdlib", "rule_id": "GO-2026-4601", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-25679|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4403", "level": "error", "message": {"text": "stdlib: GO-2026-4403"}, "properties": {"repobilityId": 224457, "scanner": "osv-scanner", "fingerprint": "64deb808b2642b8673c916c524012f13a72b1f2d7c53c8764b98155b220e6e10", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-22873", "CVE-2025-22873"], "package": "stdlib", "rule_id": "GO-2026-4403", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-22873|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4342", "level": "error", "message": {"text": "stdlib: GO-2026-4342"}, "properties": {"repobilityId": 224453, "scanner": "osv-scanner", "fingerprint": "5f9663d66234e2802084342956b590a8cd26d94c06b9666a0b484f59c7230d80", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61728", "CVE-2025-61728"], "package": "stdlib", "rule_id": "GO-2026-4342", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61728|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4341", "level": "error", "message": {"text": "stdlib: GO-2026-4341"}, "properties": {"repobilityId": 224451, "scanner": "osv-scanner", "fingerprint": "487025777bb18dbeead9864bc055c7e7ecebdf09c21c162013245cbb7e011a0e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61726", "CVE-2025-61726"], "package": "stdlib", "rule_id": "GO-2026-4341", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61726|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4340", "level": "error", "message": {"text": "stdlib: GO-2026-4340"}, "properties": {"repobilityId": 224449, "scanner": "osv-scanner", "fingerprint": "1a18d093b7e5e5e16038eb131ae84af19a6242e23d834a25e355b9b9605083ce", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61730", "CVE-2025-61730"], "package": "stdlib", "rule_id": "GO-2026-4340", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61730|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4337", "level": "error", "message": {"text": "stdlib: GO-2026-4337"}, "properties": {"repobilityId": 224446, "scanner": "osv-scanner", "fingerprint": "12d735c2594679f315ad83cf87338d9e1c92cc42acd4634c8f41d0346b1a2f72", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-68121", "CVE-2025-68121"], "package": "stdlib", "rule_id": "GO-2026-4337", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-68121|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4175", "level": "error", "message": {"text": "stdlib: GO-2025-4175"}, "properties": {"repobilityId": 224444, "scanner": "osv-scanner", "fingerprint": "39b28459b5eb32b6e78b6b124d57149b42560332ce54e343f5d66ba55b84d2d3", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61727", "CVE-2025-61727"], "package": "stdlib", "rule_id": "GO-2025-4175", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61727|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4155", "level": "error", "message": {"text": "stdlib: GO-2025-4155"}, "properties": {"repobilityId": 224442, "scanner": "osv-scanner", "fingerprint": "9c6453364b09c721d8187bfc1491100dee58cb1a2548ccf3a9a0daa1661d3f7b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61729", "CVE-2025-61729"], "package": "stdlib", "rule_id": "GO-2025-4155", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61729|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4015", "level": "error", "message": {"text": "stdlib: GO-2025-4015"}, "properties": {"repobilityId": 224441, "scanner": "osv-scanner", "fingerprint": "ac267b37c91043eef3739231cd728b8611e9d9075fb35566495ac874462ee327", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61724", "CVE-2025-61724"], "package": "stdlib", "rule_id": "GO-2025-4015", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61724|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4014", "level": "error", "message": {"text": "stdlib: GO-2025-4014"}, "properties": {"repobilityId": 224439, "scanner": "osv-scanner", "fingerprint": "319e5f7d3cb84fd7b0f4a11b577bfe58884679e73925a1c05eb3ea3cb232f24b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58183", "CVE-2025-58183"], "package": "stdlib", "rule_id": "GO-2025-4014", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58183|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4013", "level": "error", "message": {"text": "stdlib: GO-2025-4013"}, "properties": {"repobilityId": 224438, "scanner": "osv-scanner", "fingerprint": "11f0e3b5d71fe2ef4766b6e314260afcc0db6432f09dffb64fb40a4ddcdd6eb8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58188", "CVE-2025-58188"], "package": "stdlib", "rule_id": "GO-2025-4013", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58188|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4012", "level": "error", "message": {"text": "stdlib: GO-2025-4012"}, "properties": {"repobilityId": 224436, "scanner": "osv-scanner", "fingerprint": "9957a9bd7f67edf05e01fc1fb668eed6d242b62b3c27cddadbd32e69ec3976c2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58186", "CVE-2025-58186"], "package": "stdlib", "rule_id": "GO-2025-4012", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58186|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4011", "level": "error", "message": {"text": "stdlib: GO-2025-4011"}, "properties": {"repobilityId": 224433, "scanner": "osv-scanner", "fingerprint": "8744858a9f8b9284d2ef2b81c15a4e817993bfb5e66e0cab2d8d7cec0e67d859", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58185", "CVE-2025-58185"], "package": "stdlib", "rule_id": "GO-2025-4011", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58185|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4010", "level": "error", "message": {"text": "stdlib: GO-2025-4010"}, "properties": {"repobilityId": 224430, "scanner": "osv-scanner", "fingerprint": "6d82c116bceb5ac78ed534d016cd16d9951dec161869d9100534ca5c7fa451ce", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47912", "CVE-2025-47912"], "package": "stdlib", "rule_id": "GO-2025-4010", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47912|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4009", "level": "error", "message": {"text": "stdlib: GO-2025-4009"}, "properties": {"repobilityId": 224429, "scanner": "osv-scanner", "fingerprint": "65f72fff508bf68f650e167831c23bba29e86516e560e691b4473b5f8112ce88", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61723", "CVE-2025-61723"], "package": "stdlib", "rule_id": "GO-2025-4009", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61723|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4008", "level": "error", "message": {"text": "stdlib: GO-2025-4008"}, "properties": {"repobilityId": 224428, "scanner": "osv-scanner", "fingerprint": "5af558858bec1393ba2c71786cdc433fd5b67474cc8fea774c64162e348c1ae2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58189", "CVE-2025-58189"], "package": "stdlib", "rule_id": "GO-2025-4008", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58189|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4007", "level": "error", "message": {"text": "stdlib: GO-2025-4007"}, "properties": {"repobilityId": 224427, "scanner": "osv-scanner", "fingerprint": "4bfe7cd28e19b356088d41c9063bd846620dbdace8efea830a4437b771b2fc8c", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58187", "CVE-2025-58187"], "package": "stdlib", "rule_id": "GO-2025-4007", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58187|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4006", "level": "error", "message": {"text": "stdlib: GO-2025-4006"}, "properties": {"repobilityId": 224426, "scanner": "osv-scanner", "fingerprint": "ee13f5b7af04a833d713b8f04bcfcbc448568d7247b8122895f657998ba9606f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61725", "CVE-2025-61725"], "package": "stdlib", "rule_id": "GO-2025-4006", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61725|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3956", "level": "error", "message": {"text": "stdlib: GO-2025-3956"}, "properties": {"repobilityId": 224424, "scanner": "osv-scanner", "fingerprint": "1da96443229a85cd2abc7725b67b71b88e635b90a68ed9f028653feb6655636f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47906", "CVE-2025-47906"], "package": "stdlib", "rule_id": "GO-2025-3956", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47906|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3849", "level": "error", "message": {"text": "stdlib: GO-2025-3849"}, "properties": {"repobilityId": 224423, "scanner": "osv-scanner", "fingerprint": "0eb1a4234c2d03f104076b27ef237f59fc4111554d30e77082b80daffa1199c7", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47907", "CVE-2025-47907"], "package": "stdlib", "rule_id": "GO-2025-3849", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47907|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3751", "level": "error", "message": {"text": "stdlib: GO-2025-3751"}, "properties": {"repobilityId": 224422, "scanner": "osv-scanner", "fingerprint": "94e739678d38c2e004019f75fcbbc4f33ab0cd964fce1562bdd144801a842dff", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-4673", "CVE-2025-4673"], "package": "stdlib", "rule_id": "GO-2025-3751", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-4673|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3750", "level": "error", "message": {"text": "stdlib: GO-2025-3750"}, "properties": {"repobilityId": 224421, "scanner": "osv-scanner", "fingerprint": "4f6b23aa69b3e73e528798b17b87827f1d002b56c689b4d56f7b3a68316f68e8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-0913", "CVE-2025-0913"], "package": "stdlib", "rule_id": "GO-2025-3750", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-0913|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3749", "level": "error", "message": {"text": "stdlib: GO-2025-3749"}, "properties": {"repobilityId": 224420, "scanner": "osv-scanner", "fingerprint": "222e383f3f78903658fa9c86731e3b77d045157dc9f753b4dfc6c0dd3601e625", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-22874", "CVE-2025-22874"], "package": "stdlib", "rule_id": "GO-2025-3749", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-22874|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3563", "level": "error", "message": {"text": "stdlib: GO-2025-3563"}, "properties": {"repobilityId": 224419, "scanner": "osv-scanner", "fingerprint": "a3ff30a4d087176a8cb9fdc9a79d8ac3720387c1bdfbf93309bff4c343ea2fce", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-22871", "CVE-2025-22871", "GHSA-g9pc-8g42-g6vq"], "package": "stdlib", "rule_id": "GO-2025-3563", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-22871|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3503", "level": "error", "message": {"text": "stdlib: GO-2025-3503"}, "properties": {"repobilityId": 224418, "scanner": "osv-scanner", "fingerprint": "2749ab13a22925dbbd2edcc1b4b177af891bb9b8087e269fb3977ccfdcc8af90", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-22870", "GHSA-qxp5-gwg8-xv66"], "package": "stdlib", "rule_id": "GO-2025-3503", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-22870|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5024", "level": "error", "message": {"text": "golang.org/x/sys: GO-2026-5024"}, "properties": {"repobilityId": 224416, "scanner": "osv-scanner", "fingerprint": "e1ffbde2d8963ffee0cdafeee0b6817f6c5ab637668d8722467994042446c82e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39824"], "package": "golang.org/x/sys", "rule_id": "GO-2026-5024", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/sys|CVE-2026-39824|tools/replay/go.mod"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/replay/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-69v7-xpr6-6gjm", "level": "error", "message": {"text": "lupa: GHSA-69v7-xpr6-6gjm"}, "properties": {"repobilityId": 224414, "scanner": "osv-scanner", "fingerprint": "e3e896ddf96208f76042d77f28b36873dce458728be9f225c5bcdf959f11a476", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-34444"], "package": "lupa", "rule_id": "GHSA-69v7-xpr6-6gjm", "scanner": "osv-scanner", "correlation_key": "vuln|lupa|CVE-2026-34444|tests/fakeredis/poetry.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2023-117", "level": "error", "message": {"text": "pygments: PYSEC-2023-117"}, "properties": {"repobilityId": 224411, "scanner": "osv-scanner", "fingerprint": "e80a140526dfabe5ccfaeba82dcf779101cdc1c05ecd32725e1698dfd55990ac", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2022-40896", "GHSA-mrwq-x4v8-fh7p"], "package": "pygments", "rule_id": "PYSEC-2023-117", "scanner": "osv-scanner", "correlation_key": "vuln|pygments|CVE-2022-40896|token", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-mrwq-x4v8-fh7p", "PYSEC-2023-117"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["e80a140526dfabe5ccfaeba82dcf779101cdc1c05ecd32725e1698dfd55990ac", "ec444a0d47a233bbc1091bd79fde16aa2b5dbf6d79864c743471c7bf3af0cfca"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5039", "level": "error", "message": {"text": "stdlib: GO-2026-5039"}, "properties": {"repobilityId": 224409, "scanner": "osv-scanner", "fingerprint": "f52f0166e689722593abcc5bf013df94f58a757be7912bd134d3e947e843602d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42507", "CVE-2026-42507"], "package": "stdlib", "rule_id": "GO-2026-5039", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42507|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5038", "level": "error", "message": {"text": "stdlib: GO-2026-5038"}, "properties": {"repobilityId": 224407, "scanner": "osv-scanner", "fingerprint": "8f7b52f6639054c86c92d682a4277253bab6d9e9af7dfbbb689b5ff32934af95", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42504", "CVE-2026-42504"], "package": "stdlib", "rule_id": "GO-2026-5038", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42504|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5037", "level": "error", "message": {"text": "stdlib: GO-2026-5037"}, "properties": {"repobilityId": 224405, "scanner": "osv-scanner", "fingerprint": "546a33e6a6e8bc87fd462f0ecaeaf3c69207f9ba9f1656f31eadbc27e88990c6", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27145", "CVE-2026-27145"], "package": "stdlib", "rule_id": "GO-2026-5037", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27145|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4986", "level": "error", "message": {"text": "stdlib: GO-2026-4986"}, "properties": {"repobilityId": 224404, "scanner": "osv-scanner", "fingerprint": "88b8e17ce04444187c74eef91638fcfc4e71f01bcb18ccaa21bfc40f3b44c3fe", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39820", "CVE-2026-39820"], "package": "stdlib", "rule_id": "GO-2026-4986", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39820|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4982", "level": "error", "message": {"text": "stdlib: GO-2026-4982"}, "properties": {"repobilityId": 224402, "scanner": "osv-scanner", "fingerprint": "16eaa65184f520ba1aa16b7169c141248f285d72c4cdc94d34e2f3f002122f9c", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39823", "CVE-2026-39823"], "package": "stdlib", "rule_id": "GO-2026-4982", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39823|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4981", "level": "error", "message": {"text": "stdlib: GO-2026-4981"}, "properties": {"repobilityId": 224401, "scanner": "osv-scanner", "fingerprint": "e00546b632321e48ff4fa443eb2e1c3256c07efe6ccbff17f6affb8d0efc17c2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33811", "CVE-2026-33811"], "package": "stdlib", "rule_id": "GO-2026-4981", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-33811|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4980", "level": "error", "message": {"text": "stdlib: GO-2026-4980"}, "properties": {"repobilityId": 224400, "scanner": "osv-scanner", "fingerprint": "b8e25780fd10c4be22309c00b24a4d251a5290b68fff6c6417abe7f1501cf705", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39826", "CVE-2026-39826"], "package": "stdlib", "rule_id": "GO-2026-4980", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39826|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4977", "level": "error", "message": {"text": "stdlib: GO-2026-4977"}, "properties": {"repobilityId": 224397, "scanner": "osv-scanner", "fingerprint": "e8036fae3035ac33703b71ef422bab7179e82f56705c0a4a2140f352befefbaf", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-42499", "CVE-2026-42499"], "package": "stdlib", "rule_id": "GO-2026-4977", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-42499|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4976", "level": "error", "message": {"text": "stdlib: GO-2026-4976"}, "properties": {"repobilityId": 224396, "scanner": "osv-scanner", "fingerprint": "86f6cb8b01c2e3c8a61d41353895e79036bb959cc9d61117452bff778995fae8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39825", "CVE-2026-39825"], "package": "stdlib", "rule_id": "GO-2026-4976", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39825|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4971", "level": "error", "message": {"text": "stdlib: GO-2026-4971"}, "properties": {"repobilityId": 224395, "scanner": "osv-scanner", "fingerprint": "0e40f75d626529fedf2ea459f3eb77817e360217f16320225b397699840d6bcd", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-39836", "CVE-2026-39836"], "package": "stdlib", "rule_id": "GO-2026-4971", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-39836|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4947", "level": "error", "message": {"text": "stdlib: GO-2026-4947"}, "properties": {"repobilityId": 224391, "scanner": "osv-scanner", "fingerprint": "e1d5ca6df6899dfb11e9892d206f24d900d08da64d13424a0a49a5a8f49440d3", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32280", "CVE-2026-32280"], "package": "stdlib", "rule_id": "GO-2026-4947", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32280|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4946", "level": "error", "message": {"text": "stdlib: GO-2026-4946"}, "properties": {"repobilityId": 224390, "scanner": "osv-scanner", "fingerprint": "6590ed65fd9c9b9036761c96748a93ef452edd16ab5eea7df907e9227d038bc9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32281", "CVE-2026-32281"], "package": "stdlib", "rule_id": "GO-2026-4946", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32281|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4918", "level": "error", "message": {"text": "stdlib: GO-2026-4918"}, "properties": {"repobilityId": 224386, "scanner": "osv-scanner", "fingerprint": "07b7ae2fdaef6170d9766b81674152f358bb0d0ce155218988cb2a13e55b8c1f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33814", "CVE-2026-33814"], "package": "stdlib", "rule_id": "GO-2026-4918", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-33814|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4870", "level": "error", "message": {"text": "stdlib: GO-2026-4870"}, "properties": {"repobilityId": 224385, "scanner": "osv-scanner", "fingerprint": "8d3e97bf08527c1b7a229c41ecb828b8b920cf7ddb7f9b2873ebd00c3eb1ddc4", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32283", "CVE-2026-32283"], "package": "stdlib", "rule_id": "GO-2026-4870", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32283|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4869", "level": "error", "message": {"text": "stdlib: GO-2026-4869"}, "properties": {"repobilityId": 224382, "scanner": "osv-scanner", "fingerprint": "1ce7e5c478991bb8b577b54341b4df7189ddf445367532f63a0b1fd99007f873", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32288", "CVE-2026-32288"], "package": "stdlib", "rule_id": "GO-2026-4869", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32288|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4865", "level": "error", "message": {"text": "stdlib: GO-2026-4865"}, "properties": {"repobilityId": 224380, "scanner": "osv-scanner", "fingerprint": "9a896be189d10138c46ffd0c6f7a7a9d754447011ffac8f6a309fdaabcdc28c2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32289", "CVE-2026-32289"], "package": "stdlib", "rule_id": "GO-2026-4865", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32289|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4864", "level": "error", "message": {"text": "stdlib: GO-2026-4864"}, "properties": {"repobilityId": 224379, "scanner": "osv-scanner", "fingerprint": "9ad18954e08e09d34f40146ccef9f59d9376625813dc8596dc438068c88de607", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-32282", "CVE-2026-32282"], "package": "stdlib", "rule_id": "GO-2026-4864", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-32282|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4603", "level": "error", "message": {"text": "stdlib: GO-2026-4603"}, "properties": {"repobilityId": 224377, "scanner": "osv-scanner", "fingerprint": "0bf0788dd9c2354dfcefa51515dd555cf9829cd893af61b4393ad82e6c192500", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27142", "CVE-2026-27142"], "package": "stdlib", "rule_id": "GO-2026-4603", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27142|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4602", "level": "error", "message": {"text": "stdlib: GO-2026-4602"}, "properties": {"repobilityId": 224376, "scanner": "osv-scanner", "fingerprint": "11ea5f532884f81ac19fb3a3f110484d19a7c85ef62119f3fab8b1ffc37d0977", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-27139", "CVE-2026-27139"], "package": "stdlib", "rule_id": "GO-2026-4602", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-27139|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4601", "level": "error", "message": {"text": "stdlib: GO-2026-4601"}, "properties": {"repobilityId": 224371, "scanner": "osv-scanner", "fingerprint": "1d4e4b3bde74c8e40ab5065d465eb6b8a5243b4d5684846aae2d8b480cdd1aac", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-25679", "CVE-2026-25679"], "package": "stdlib", "rule_id": "GO-2026-4601", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2026-25679|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4342", "level": "error", "message": {"text": "stdlib: GO-2026-4342"}, "properties": {"repobilityId": 224370, "scanner": "osv-scanner", "fingerprint": "b217f65d9d751f9cb61ccc9adaf321ac1bfda3c9686cf88b6c282f32095fa89a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61728", "CVE-2025-61728"], "package": "stdlib", "rule_id": "GO-2026-4342", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61728|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4341", "level": "error", "message": {"text": "stdlib: GO-2026-4341"}, "properties": {"repobilityId": 224369, "scanner": "osv-scanner", "fingerprint": "b745da538b3caa57d8367853eb91985a703c33d8d8ffb46450a5357161cf3cae", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61726", "CVE-2025-61726"], "package": "stdlib", "rule_id": "GO-2026-4341", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61726|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4340", "level": "error", "message": {"text": "stdlib: GO-2026-4340"}, "properties": {"repobilityId": 224368, "scanner": "osv-scanner", "fingerprint": "eafd948f7c639fba60af30cf02d67748b8f9c3747e611edd444ceb720f59f3af", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61730", "CVE-2025-61730"], "package": "stdlib", "rule_id": "GO-2026-4340", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61730|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4337", "level": "error", "message": {"text": "stdlib: GO-2026-4337"}, "properties": {"repobilityId": 224365, "scanner": "osv-scanner", "fingerprint": "b59c86bdbeaa20a2633df3c721e730bac10d4295b19f7ac566f90834c25294bb", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-68121", "CVE-2025-68121"], "package": "stdlib", "rule_id": "GO-2026-4337", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-68121|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4175", "level": "error", "message": {"text": "stdlib: GO-2025-4175"}, "properties": {"repobilityId": 224364, "scanner": "osv-scanner", "fingerprint": "ab8c5e9e572b70bf14d9a121c091a8f3c872e4181d9b76f92c739c9752432309", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61727", "CVE-2025-61727"], "package": "stdlib", "rule_id": "GO-2025-4175", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61727|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4155", "level": "error", "message": {"text": "stdlib: GO-2025-4155"}, "properties": {"repobilityId": 224363, "scanner": "osv-scanner", "fingerprint": "3199be4b2023c68d1ce01400e969ef2e2f76d20ac203eb7d28c3a204b5824ac2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61729", "CVE-2025-61729"], "package": "stdlib", "rule_id": "GO-2025-4155", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61729|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4015", "level": "error", "message": {"text": "stdlib: GO-2025-4015"}, "properties": {"repobilityId": 224362, "scanner": "osv-scanner", "fingerprint": "b77c398d9bca5f2a5a8d217128008ef532d5b35d273ab380e505533ddb467964", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61724", "CVE-2025-61724"], "package": "stdlib", "rule_id": "GO-2025-4015", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61724|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4014", "level": "error", "message": {"text": "stdlib: GO-2025-4014"}, "properties": {"repobilityId": 224361, "scanner": "osv-scanner", "fingerprint": "fcba28f43cec254d656910e745b52ced21ad649601a9af3743bad5ec9f356e23", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58183", "CVE-2025-58183"], "package": "stdlib", "rule_id": "GO-2025-4014", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58183|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4013", "level": "error", "message": {"text": "stdlib: GO-2025-4013"}, "properties": {"repobilityId": 224360, "scanner": "osv-scanner", "fingerprint": "cf7a00f72f8df7475be1f51c7453b574b95de9b224127010fb517ea23a910110", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58188", "CVE-2025-58188"], "package": "stdlib", "rule_id": "GO-2025-4013", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58188|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4012", "level": "error", "message": {"text": "stdlib: GO-2025-4012"}, "properties": {"repobilityId": 224359, "scanner": "osv-scanner", "fingerprint": "f84fd747a8f1f5bcf18615f43d132b878e1a2fe6e8defa7023fc75b5ebe028a5", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58186", "CVE-2025-58186"], "package": "stdlib", "rule_id": "GO-2025-4012", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58186|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4011", "level": "error", "message": {"text": "stdlib: GO-2025-4011"}, "properties": {"repobilityId": 224358, "scanner": "osv-scanner", "fingerprint": "6df204db0a72f164413e78e3c8612cc739513726018f12a035e1c4410195368f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58185", "CVE-2025-58185"], "package": "stdlib", "rule_id": "GO-2025-4011", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58185|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4010", "level": "error", "message": {"text": "stdlib: GO-2025-4010"}, "properties": {"repobilityId": 224357, "scanner": "osv-scanner", "fingerprint": "29e9a863656aa6607a3ca09fa8f77370b080da3352e34e5379b51a6f5b751288", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47912", "CVE-2025-47912"], "package": "stdlib", "rule_id": "GO-2025-4010", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47912|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4009", "level": "error", "message": {"text": "stdlib: GO-2025-4009"}, "properties": {"repobilityId": 224356, "scanner": "osv-scanner", "fingerprint": "7821fc9a4583763a5e529e4b50d12cb2775c64cacc5173596fbd9ba4d9193387", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61723", "CVE-2025-61723"], "package": "stdlib", "rule_id": "GO-2025-4009", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61723|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4008", "level": "error", "message": {"text": "stdlib: GO-2025-4008"}, "properties": {"repobilityId": 224355, "scanner": "osv-scanner", "fingerprint": "8902dc054338fc64f65373f543c0b9456c780394325fb82bf2955561b201dcb0", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58189", "CVE-2025-58189"], "package": "stdlib", "rule_id": "GO-2025-4008", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58189|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4007", "level": "error", "message": {"text": "stdlib: GO-2025-4007"}, "properties": {"repobilityId": 224354, "scanner": "osv-scanner", "fingerprint": "a580fc37fa5c1fb033f9e2b7986d9cc6f2a2b05ad72802dd75a50f78795d23e3", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-58187", "CVE-2025-58187"], "package": "stdlib", "rule_id": "GO-2025-4007", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-58187|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4006", "level": "error", "message": {"text": "stdlib: GO-2025-4006"}, "properties": {"repobilityId": 224353, "scanner": "osv-scanner", "fingerprint": "ec06ea8e859a6ba56f0702a01017b02bf18ed901e565456c440c2172cd34568d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-61725", "CVE-2025-61725"], "package": "stdlib", "rule_id": "GO-2025-4006", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-61725|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-3955", "level": "error", "message": {"text": "stdlib: GO-2025-3955"}, "properties": {"repobilityId": 224352, "scanner": "osv-scanner", "fingerprint": "76093fb9adfa328807d22a48f13b3ca97d6c9ecf197e82eff7a95d1e647c6a21", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2025-47910", "CVE-2025-47910"], "package": "stdlib", "rule_id": "GO-2025-3955", "scanner": "osv-scanner", "correlation_key": "vuln|stdlib|CVE-2025-47910|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5024", "level": "error", "message": {"text": "golang.org/x/sys: GO-2026-5024"}, "properties": {"repobilityId": 224351, "scanner": "osv-scanner", "fingerprint": "2dd95e64896c8d0e8b7adc02051df36c8b7689b015b74d05f071e3bee381fa69", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39824"], "package": "golang.org/x/sys", "rule_id": "GO-2026-5024", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/sys|CVE-2026-39824|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5030", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-5030"}, "properties": {"repobilityId": 224350, "scanner": "osv-scanner", "fingerprint": "c36897af4be41fd7d67886fc7b526c04405b9c8f170161ea6743480a23c23ec7", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-27136"], "package": "golang.org/x/net", "rule_id": "GO-2026-5030", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-27136|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5029", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-5029"}, "properties": {"repobilityId": 224349, "scanner": "osv-scanner", "fingerprint": "39336278976dfc6df2f9927691b664f703351e42c1922b5d4830071ae7111dbb", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-25681"], "package": "golang.org/x/net", "rule_id": "GO-2026-5029", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-25681|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5028", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-5028"}, "properties": {"repobilityId": 224348, "scanner": "osv-scanner", "fingerprint": "d68dfa2b6719329b415abb862c0a98ec092e4f8ff415f61ebd101e74f92da336", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-25680"], "package": "golang.org/x/net", "rule_id": "GO-2026-5028", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-25680|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5027", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-5027"}, "properties": {"repobilityId": 224347, "scanner": "osv-scanner", "fingerprint": "aa1aefae8cb95ee6d582346ec1fe7d895e484c78b18bd148259817aecdcb1a6f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-42502"], "package": "golang.org/x/net", "rule_id": "GO-2026-5027", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-42502|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5026", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-5026"}, "properties": {"repobilityId": 224346, "scanner": "osv-scanner", "fingerprint": "5e30992681d408ff34beb1b1d2dca9e12082b47684eef2c5723a42407831ee66", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39821"], "package": "golang.org/x/net", "rule_id": "GO-2026-5026", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-39821|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5025", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-5025"}, "properties": {"repobilityId": 224345, "scanner": "osv-scanner", "fingerprint": "66e5f4c24ddc37716408875dbd6f7265536f70b978967372dae70dfaad68dc46", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-42506"], "package": "golang.org/x/net", "rule_id": "GO-2026-5025", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-42506|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4918", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-4918"}, "properties": {"repobilityId": 224344, "scanner": "osv-scanner", "fingerprint": "97cfbd4f3d0fb6d1a38cc5d7c43a289a617cc2d99b5e4e0bbe27c9ed700b324a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["BIT-golang-2026-33814", "CVE-2026-33814"], "package": "golang.org/x/net", "rule_id": "GO-2026-4918", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2026-33814|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4441", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-4441"}, "properties": {"repobilityId": 224343, "scanner": "osv-scanner", "fingerprint": "b6138bd637a1d13c9f2c97c166c6128e0971c1c4904b8216499da03b7b8c994e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-58190"], "package": "golang.org/x/net", "rule_id": "GO-2026-4441", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2025-58190|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-4440", "level": "error", "message": {"text": "golang.org/x/net: GO-2026-4440"}, "properties": {"repobilityId": 224342, "scanner": "osv-scanner", "fingerprint": "cfe2563359ef87e0a1dd14b0f8fa2ef40530c369cf3d039a6f8a7384b1eb9add", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-47911", "GHSA-w4gw-w5jq-g9jh"], "package": "golang.org/x/net", "rule_id": "GO-2026-4440", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/net|CVE-2025-47911|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5033", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5033"}, "properties": {"repobilityId": 224341, "scanner": "osv-scanner", "fingerprint": "cf896050706d2136eb10d1835c70dc0a6d4909c583fdfcc3af9a8e245e5b1d5a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-46598"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5033", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-46598|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5023", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5023"}, "properties": {"repobilityId": 224340, "scanner": "osv-scanner", "fingerprint": "b8561f23b81136e64a051b41134720acf318889add8cb9973b7356fde77ac5de", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-46595"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5023", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-46595|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5021", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5021"}, "properties": {"repobilityId": 224339, "scanner": "osv-scanner", "fingerprint": "94db2ba01d8c5c7b4f40327816421fc2aa342a14d415fb5d655c2c11a675539f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-42508"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5021", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-42508|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5020", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5020"}, "properties": {"repobilityId": 224338, "scanner": "osv-scanner", "fingerprint": "dd67aba07833632f9abd0ac0ebd60adf9056ace95a3a0ab2bf9dff0f50491974", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39834"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5020", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39834|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5019", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5019"}, "properties": {"repobilityId": 224337, "scanner": "osv-scanner", "fingerprint": "08a16c26667bed307f6e0675dd64e93dd7f2dc6ba35a5f0651e3b14e95696b6b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39831"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5019", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39831|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5018", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5018"}, "properties": {"repobilityId": 224336, "scanner": "osv-scanner", "fingerprint": "7f67530543d05cb68c88841232a9c0b55c6abfc926cc43a4cd1126925b7f9912", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39829"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5018", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39829|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5017", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5017"}, "properties": {"repobilityId": 224335, "scanner": "osv-scanner", "fingerprint": "3f45e5518cf2a92363227138618a5e679a25207f66b9c6d2e950f4bbc1a8c2c8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39830"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5017", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39830|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5016", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5016"}, "properties": {"repobilityId": 224334, "scanner": "osv-scanner", "fingerprint": "e03fc52e316755acdd3c9c154355f0e6f5e694993b7a210fe3ac6ae425e1e696", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39827"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5016", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39827|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5015", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5015"}, "properties": {"repobilityId": 224333, "scanner": "osv-scanner", "fingerprint": "b1ffa70264356589b6cf613d5a44e03b304d38052f4e1625e081b7988e29deb3", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39835"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5015", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39835|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5014", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5014"}, "properties": {"repobilityId": 224332, "scanner": "osv-scanner", "fingerprint": "2ab7d3f2d18ebd5c46534c32e5f7e2562c2815750f1cf03a20bbf111a362c34a", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39828"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5014", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39828|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5013", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5013"}, "properties": {"repobilityId": 224331, "scanner": "osv-scanner", "fingerprint": "05e3eb5c4e7641d78a8f363d66669ff05c5eea644aa541b3f3a4450c3c7e4eb1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-46597"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5013", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-46597|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5006", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5006"}, "properties": {"repobilityId": 224330, "scanner": "osv-scanner", "fingerprint": "4168762e0b685003953c00760f6b159c4917c23f3451e5b29369d82d01cf62b8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39832"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5006", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39832|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2026-5005", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2026-5005"}, "properties": {"repobilityId": 224329, "scanner": "osv-scanner", "fingerprint": "85cd7b39dc8196afd59bbd8636fdacf10862ad3777d897cba68c8ceac8c8ed25", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39833"], "package": "golang.org/x/crypto", "rule_id": "GO-2026-5005", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2026-39833|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4135", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2025-4135"}, "properties": {"repobilityId": 224328, "scanner": "osv-scanner", "fingerprint": "d9b7e5231e90bf8d928fc9b6447422a7da79d14da88bc226e78fe5efac751e3b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-47914", "GHSA-f6x5-jh6r-wrfv"], "package": "golang.org/x/crypto", "rule_id": "GO-2025-4135", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2025-47914|token", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-f6x5-jh6r-wrfv", "GO-2025-4135"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["d9b7e5231e90bf8d928fc9b6447422a7da79d14da88bc226e78fe5efac751e3b", "e3d5e24b15b8066c657ab323b7a82ef1c445a8bd1959017be0b2e95724d0c724"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4134", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2025-4134"}, "properties": {"repobilityId": 224327, "scanner": "osv-scanner", "fingerprint": "029b8144f8c9d2b06e48cdebe009e8665b0e625339af19b56ed5ec273a5596d8", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-58181", "GHSA-j5w8-q4qc-rx2x"], "package": "golang.org/x/crypto", "rule_id": "GO-2025-4134", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2025-58181|token", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-j5w8-q4qc-rx2x", "GO-2025-4134"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["029b8144f8c9d2b06e48cdebe009e8665b0e625339af19b56ed5ec273a5596d8", "5092a7f180531b2dd7560f105819001c82a07a38ff90e42f124a77fdea210c2e"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "GO-2025-4116", "level": "error", "message": {"text": "golang.org/x/crypto: GO-2025-4116"}, "properties": {"repobilityId": 224326, "scanner": "osv-scanner", "fingerprint": "6f8af0715e8e42fbf50014de9a88689c72a99daa50fffd263408a1a5bb7c9fe7", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-47913", "GHSA-56w8-48fp-6mgv"], "package": "golang.org/x/crypto", "rule_id": "GO-2025-4116", "scanner": "osv-scanner", "correlation_key": "vuln|golang.org/x/crypto|CVE-2025-47913|token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/go.mod"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 224311, "scanner": "repobility-docker", "fingerprint": "decc896cb4f7f7ec9213ad0533f30f760806291e490655700d6d147b575a8d40", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "9121:9121", "target": "9121", "host_ip": "", "published": "9121"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "redis-exporter", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|decc896cb4f7f7ec9213ad0533f30f760806291e490655700d6d147b575a8d40"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "DKC003", "level": "error", "message": {"text": "Compose service joins the host PID namespace"}, "properties": {"repobilityId": 224307, "scanner": "repobility-docker", "fingerprint": "a5f526dff17a3ac7f50bf5affc9dc1f08820ed5395b7a96df88ac7c31fd7cb9b", "category": "docker", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "pid: host was set on the service.", "evidence": {"rule_id": "DKC003", "scanner": "repobility-docker", "service": "memcached-exporter", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|a5f526dff17a3ac7f50bf5affc9dc1f08820ed5395b7a96df88ac7c31fd7cb9b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "DKC009", "level": "error", "message": {"text": "Compose service bind-mounts a sensitive host path"}, "properties": {"repobilityId": 224303, "scanner": "repobility-docker", "fingerprint": "c583586e0876a493d056d9fbbb3c5d0c3e75b0e1e9a7adad5a8c6075637923d9", "category": "docker", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Bind mount source points at a sensitive host path.", "evidence": {"source": "/proc", "rule_id": "DKC009", "scanner": "repobility-docker", "service": "node-exporter", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|c583586e0876a493d056d9fbbb3c5d0c3e75b0e1e9a7adad5a8c6075637923d9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "DKC003", "level": "error", "message": {"text": "Compose service joins the host PID namespace"}, "properties": {"repobilityId": 224298, "scanner": "repobility-docker", "fingerprint": "df26cef0cd09f8192fb8daac2d6840d19860b7662de93907781c4ebd834100f6", "category": "docker", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "pid: host was set on the service.", "evidence": {"rule_id": "DKC003", "scanner": "repobility-docker", "service": "memcached", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|df26cef0cd09f8192fb8daac2d6840d19860b7662de93907781c4ebd834100f6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "DKC006", "level": "error", "message": {"text": "Compose service explicitly runs as root"}, "properties": {"repobilityId": 224294, "scanner": "repobility-docker", "fingerprint": "d18211add3b015345e45b69b1d37cc5b076b637d02cd36f4bd70d51a7ee1b0ff", "category": "docker", "severity": "high", "confidence": 0.92, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "The service sets user to root and no privilege-drop wrapper was detected.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "change_vol_ownership", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|d18211add3b015345e45b69b1d37cc5b076b637d02cd36f4bd70d51a7ee1b0ff"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/local/monitoring/docker-compose.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "MINED016", "level": "error", "message": {"text": "[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern."}, "properties": {"repobilityId": 224278, "scanner": "repobility-threat-engine", "fingerprint": "bec5bc9901553c13c6f1898a3d5b39f31e8f714f4a3d8e96c29693125f660241", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-error-ignored", "owasp": null, "cwe_ids": ["CWE-754"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347935+00:00", "triaged_in_corpus": 15, "observations_count": 83036, "ai_coder_pattern_id": 107}, "scanner": "repobility-threat-engine", "correlation_key": "fp|bec5bc9901553c13c6f1898a3d5b39f31e8f714f4a3d8e96c29693125f660241"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/vector-benches/main.go"}, "region": {"startLine": 63}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 224275, "scanner": "repobility-threat-engine", "fingerprint": "8fd19300962b3dd7e81c01e401a0a4c00321df35170cc9578deac5fa38158605", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8fd19300962b3dd7e81c01e401a0a4c00321df35170cc9578deac5fa38158605"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/osrepos/scripts/fetch-releases.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 224274, "scanner": "repobility-threat-engine", "fingerprint": "81cd7c99a645e03f9f204503b0a7fe2b28cae8d479991cdcfb87c33fdf95972b", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(RELEASE_URL", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|81cd7c99a645e03f9f204503b0a7fe2b28cae8d479991cdcfb87c33fdf95972b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/osrepos/scripts/fetch-releases.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 224271, "scanner": "repobility-threat-engine", "fingerprint": "317dfac938f6a1990567578642b79b034a2ee6038b6d2f270c1ac865b688711c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(CmdArgList", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|317dfac938f6a1990567578642b79b034a2ee6038b6d2f270c1ac865b688711c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/main_service.h"}, "region": {"startLine": 139}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 224270, "scanner": "repobility-threat-engine", "fingerprint": "28a6de0c8534e6e631340f964b07000851c042f85ebfedaa08d6ff35486599a7", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(CommandContext", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|28a6de0c8534e6e631340f964b07000851c042f85ebfedaa08d6ff35486599a7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/debugcmd.h"}, "region": {"startLine": 50}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 224269, "scanner": "repobility-threat-engine", "fingerprint": "0bf44cb0231cc6da907ec19413e9491767bb57f78f4d35244f9c57a77c875e66", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(Args", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0bf44cb0231cc6da907ec19413e9491767bb57f78f4d35244f9c57a77c875e66"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server/cluster/coordinator.cc"}, "region": {"startLine": 33}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 224253, "scanner": "repobility-threat-engine", "fingerprint": "165dcbee590dab1a4565f7e17bd3a840cf2e60c6724ce2c3f15ff31462fd6dab", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "coro.destroy();", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|165dcbee590dab1a4565f7e17bd3a840cf2e60c6724ce2c3f15ff31462fd6dab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/facade/parsed_command.cc"}, "region": {"startLine": 131}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 224252, "scanner": "repobility-threat-engine", "fingerprint": "20fb30fa31723aecae82e6d01713066e68a57f00109e470b6071143fef394ef5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "sm_.Delete(ele);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|20fb30fa31723aecae82e6d01713066e68a57f00109e470b6071143fef394ef5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/sorted_map_test.cc"}, "region": {"startLine": 272}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 224251, "scanner": "repobility-threat-engine", "fingerprint": "534045eeef39a11aa81608f67db1cc229a3bcb419b856a14dcf3e30b594a5f8c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "parser.update(input);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|534045eeef39a11aa81608f67db1cc229a3bcb419b856a14dcf3e30b594a5f8c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/json/json_object.cc"}, "region": {"startLine": 38}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `_mutate_commands` has cognitive complexity 40 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: elif=7, else=2, except=1, if=9, nested_bonus=21."}, "properties": {"repobilityId": 224238, "scanner": "repobility-threat-engine", "fingerprint": "f09f97ea5132cc3d10d06c977ece6fb09811c075ccca3fab1e0f5f6b2fa32d9e", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 40 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "_mutate_commands", "breakdown": {"if": 9, "elif": 7, "else": 2, "except": 1, "nested_bonus": 21}, "complexity": 40, "correlation_key": "fp|f09f97ea5132cc3d10d06c977ece6fb09811c075ccca3fab1e0f5f6b2fa32d9e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/memcache_mutator.py"}, "region": {"startLine": 236}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `main` has cognitive complexity 28 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=3, else=1, except=1, for=2, if=12, nested_bonus=7, or=2."}, "properties": {"repobilityId": 224236, "scanner": "repobility-threat-engine", "fingerprint": "140f525f3ea0fd92517e050c51f4c955f9feb33b10e26e0d715ccccd5689ec5e", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 28 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "main", "breakdown": {"if": 12, "or": 2, "for": 2, "else": 1, "except": 1, "continue": 3, "nested_bonus": 7}, "complexity": 28, "correlation_key": "fp|140f525f3ea0fd92517e050c51f4c955f9feb33b10e26e0d715ccccd5689ec5e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 229}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 224231, "scanner": "repobility-threat-engine", "fingerprint": "7175a9ff62cfa4b7a0c29e9a944aaf6397b07fa26fc62c442f75f5c42164111a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7175a9ff62cfa4b7a0c29e9a944aaf6397b07fa26fc62c442f75f5c42164111a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/replay_crash.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 224230, "scanner": "repobility-threat-engine", "fingerprint": "53df3b0e702adbb70dce391efb7dd2de0fc6758830422834fe20d35a2fd3a10a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|53df3b0e702adbb70dce391efb7dd2de0fc6758830422834fe20d35a2fd3a10a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/memcache_mutator.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 224229, "scanner": "repobility-threat-engine", "fingerprint": "939716caf1896e02f20619e00508b8917961dcc26b6f7daffa444b90579ee5ba", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|939716caf1896e02f20619e00508b8917961dcc26b6f7daffa444b90579ee5ba"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fuzz/generate_targeted_seeds.py"}, "region": {"startLine": 191}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/benchmark-dev:latest` unpinned"}, "properties": {"repobilityId": 224202, "scanner": "repobility-supply-chain", "fingerprint": "b76c73cc4f6531165610030cdfa3443f66c7e4f010c0fd684b6252175ca67654", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b76c73cc4f6531165610030cdfa3443f66c7e4f010c0fd684b6252175ca67654"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/dragonflydb/dragonfly:latest` unpinned"}, "properties": {"repobilityId": 224201, "scanner": "repobility-supply-chain", "fingerprint": "c1fccebb54082310a105b510cdd1cf7d3b82c8d14d3de8968b92ac07800c54b0", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c1fccebb54082310a105b510cdd1cf7d3b82c8d14d3de8968b92ac07800c54b0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `docker.dragonflydb.io/dragonflydb/dragonfly:latest` unpinned"}, "properties": {"repobilityId": 224200, "scanner": "repobility-supply-chain", "fingerprint": "47094214de5c15a56982b3a4612d63a18782655f84e76c00305bac50618a02e8", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|47094214de5c15a56982b3a4612d63a18782655f84e76c00305bac50618a02e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mastodon-ruby-tests.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `postgres:14-alpine` unpinned"}, "properties": {"repobilityId": 224199, "scanner": "repobility-supply-chain", "fingerprint": "ff1f0dd29813144d02b39fdf8d2b6f3b22de569b7ade129148e8c39a17c7dd8c", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ff1f0dd29813144d02b39fdf8d2b6f3b22de569b7ade129148e8c39a17c7dd8c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mastodon-ruby-tests.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:24` unpinned"}, "properties": {"repobilityId": 224198, "scanner": "repobility-supply-chain", "fingerprint": "f8f28aa4494878b675e1a611c5c04ad782d4357b68335a53e8b99bea90131fd4", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f8f28aa4494878b675e1a611c5c04ad782d4357b68335a53e8b99bea90131fd4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `fedora:30-gcc14` unpinned"}, "properties": {"repobilityId": 224197, "scanner": "repobility-supply-chain", "fingerprint": "ac3fcf6f5dc5b42dd059d53580e9597650afcd84859d9958d61428a19f486f45", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ac3fcf6f5dc5b42dd059d53580e9597650afcd84859d9958d61428a19f486f45"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ubuntu-dev:20-gcc14` unpinned"}, "properties": {"repobilityId": 224196, "scanner": "repobility-supply-chain", "fingerprint": "0d104b8ad8f6e138a212157b18071aeccdc4d5aab2f7bc69c79560872aba8810", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0d104b8ad8f6e138a212157b18071aeccdc4d5aab2f7bc69c79560872aba8810"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:20-gcc14` unpinned"}, "properties": {"repobilityId": 224195, "scanner": "repobility-supply-chain", "fingerprint": "41d4ac74646d71f7112427a0ba6727fb617cae1ac7f6a2a55baca95a1968f1fa", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|41d4ac74646d71f7112427a0ba6727fb617cae1ac7f6a2a55baca95a1968f1fa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/dragonflydb/dragonfly-dev` unpinned"}, "properties": {"repobilityId": 224194, "scanner": "repobility-supply-chain", "fingerprint": "584efadb6c33b4248efe668f6749c51b3e51881ffaf2668f6c6f3fccd819daea", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|584efadb6c33b4248efe668f6749c51b3e51881ffaf2668f6c6f3fccd819daea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-dev-release.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:24` unpinned"}, "properties": {"repobilityId": 224193, "scanner": "repobility-supply-chain", "fingerprint": "0a40c3551a23a9f24ca6c79c12b773b382b0335586b57c72fd97859e059f1ceb", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0a40c3551a23a9f24ca6c79c12b773b382b0335586b57c72fd97859e059f1ceb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 288}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:20-gcc14` unpinned"}, "properties": {"repobilityId": 224190, "scanner": "repobility-supply-chain", "fingerprint": "4ce6d29a952b4d97f8520b7d537fe701e9df149d1eaa1aef384ac25883571274", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4ce6d29a952b4d97f8520b7d537fe701e9df149d1eaa1aef384ac25883571274"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bullmq-tests.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:24-afl` unpinned"}, "properties": {"repobilityId": 224189, "scanner": "repobility-supply-chain", "fingerprint": "c60cd486437d36f086f8f7422c415b23a1985a5e351603291cbb0b5a7a7b0907", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c60cd486437d36f086f8f7422c415b23a1985a5e351603291cbb0b5a7a7b0907"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzz-long.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:24-afl` unpinned"}, "properties": {"repobilityId": 224188, "scanner": "repobility-supply-chain", "fingerprint": "6a8300d91d419487cef7f8762d1ad32a3ecdba3e1136e2ab9dc6e8c69bd43535", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|6a8300d91d419487cef7f8762d1ad32a3ecdba3e1136e2ab9dc6e8c69bd43535"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fuzz-pr.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu:noble` unpinned"}, "properties": {"repobilityId": 224180, "scanner": "repobility-supply-chain", "fingerprint": "c5576b8317e1e9d19a0f66e7a84df4ad266dc75344590bdfb78a99eef927063a", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c5576b8317e1e9d19a0f66e7a84df4ad266dc75344590bdfb78a99eef927063a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/package-install.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/fedora:30` unpinned"}, "properties": {"repobilityId": 224179, "scanner": "repobility-supply-chain", "fingerprint": "d92a70e4fa5b0d643ab830527fb7bf9426469ae3d0418d610a69a4f13319a794", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d92a70e4fa5b0d643ab830527fb7bf9426469ae3d0418d610a69a4f13319a794"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/package-install.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `fedora:30-gcc14` unpinned"}, "properties": {"repobilityId": 224170, "scanner": "repobility-supply-chain", "fingerprint": "3daf24d9b7ca9e1bbc14e7277d7d66d4f2f7feae5dfaafa53212d3e30cdfaf42", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3daf24d9b7ca9e1bbc14e7277d7d66d4f2f7feae5dfaafa53212d3e30cdfaf42"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-builds.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED126", "level": "error", "message": {"text": "Workflow container/services image `ghcr.io/romange/ubuntu-dev:22` unpinned"}, "properties": {"repobilityId": 224167, "scanner": "repobility-supply-chain", "fingerprint": "f7c60b6758139b0027c1b7b43390dce85a16c6bad3b1d1cae06630e0064e5b65", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-container-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f7c60b6758139b0027c1b7b43390dce85a16c6bad3b1d1cae06630e0064e5b65"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-fakeredis.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ubuntu:22.04` not pinned by digest"}, "properties": {"repobilityId": 224157, "scanner": "repobility-supply-chain", "fingerprint": "955760497250a6280ba3137d67e217e04b796d7e3546081a00b95806fc786902", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|955760497250a6280ba3137d67e217e04b796d7e3546081a00b95806fc786902"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.ubuntu-prod"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ghcr.io/romange/ubuntu-dev:20-gcc14` not pinned by digest"}, "properties": {"repobilityId": 224156, "scanner": "repobility-supply-chain", "fingerprint": "5685a4c905bc096cb8d52e87d82eff2345a873b602010faa69e1dfa723b9a016", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5685a4c905bc096cb8d52e87d82eff2345a873b602010faa69e1dfa723b9a016"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.ubuntu-prod"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `alpine:3` not pinned by digest"}, "properties": {"repobilityId": 224155, "scanner": "repobility-supply-chain", "fingerprint": "580846f23f7e8c7433d95bc956032af157785f62b43cf504a73cf9062564d1c1", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|580846f23f7e8c7433d95bc956032af157785f62b43cf504a73cf9062564d1c1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.alpine-dev"}, "region": {"startLine": 30}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `alpine:3` not pinned by digest"}, "properties": {"repobilityId": 224154, "scanner": "repobility-supply-chain", "fingerprint": "742116846b17460fb1e50cca1a220346b5d3eb8e1adc7a0d377b0a5b7fe34924", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|742116846b17460fb1e50cca1a220346b5d3eb8e1adc7a0d377b0a5b7fe34924"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.alpine-dev"}, "region": {"startLine": 3}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `gcr.io/cadvisor/cadvisor:v0.46.0` not pinned by digest"}, "properties": {"repobilityId": 224153, "scanner": "repobility-supply-chain", "fingerprint": "f34499992177b51cc50445e0946f504f12b14d2c03028aff99be793472c4e421", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f34499992177b51cc50445e0946f504f12b14d2c03028aff99be793472c4e421"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.alpine-dev"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `gcr.io/distroless/cc-debian12 (no tag)` not pinned by digest"}, "properties": {"repobilityId": 224152, "scanner": "repobility-supply-chain", "fingerprint": "ddfdd03f8d731fd6dded43f86cb4a6bfb5989e8a83fbf0efa3ec013eb2f2cd47", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ddfdd03f8d731fd6dded43f86cb4a6bfb5989e8a83fbf0efa3ec013eb2f2cd47"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-dev"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ghcr.io/romange/ubuntu-dev:20-gcc14` not pinned by digest"}, "properties": {"repobilityId": 224151, "scanner": "repobility-supply-chain", "fingerprint": "0c25fb0e8d0e1ec0837d76625311ddf835a1e423fbb4d74a4788540f5740a757", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0c25fb0e8d0e1ec0837d76625311ddf835a1e423fbb4d74a4788540f5740a757"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-dev"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `gcr.io/distroless/cc-debian12 (no tag)` not pinned by digest"}, "properties": {"repobilityId": 224150, "scanner": "repobility-supply-chain", "fingerprint": "0bfc73d37c0a755037a59de7e153948aaac6df385dbec14c3463746cc4650fef", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0bfc73d37c0a755037a59de7e153948aaac6df385dbec14c3463746cc4650fef"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-prod"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ghcr.io/romange/ubuntu-dev:20-gcc14` not pinned by digest"}, "properties": {"repobilityId": 224149, "scanner": "repobility-supply-chain", "fingerprint": "1b4626c08ae55c805f183c7b3cacc2d3f826dd689e79a5a443f13ee09d204901", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1b4626c08ae55c805f183c7b3cacc2d3f826dd689e79a5a443f13ee09d204901"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.distroless-prod"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ubuntu:22.04` not pinned by digest"}, "properties": {"repobilityId": 224148, "scanner": "repobility-supply-chain", "fingerprint": "3917084249aeb7f46a855580ca64950a7f5d6190e8140f0495aebf76920bc5ce", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3917084249aeb7f46a855580ca64950a7f5d6190e8140f0495aebf76920bc5ce"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.ubuntu-dev"}, "region": {"startLine": 16}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ghcr.io/romange/ubuntu-dev:20-gcc14` not pinned by digest"}, "properties": {"repobilityId": 224147, "scanner": "repobility-supply-chain", "fingerprint": "12b41d48967e40ce9add831f6304c27e61e3091d63c0ee2e77492ea06504a465", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|12b41d48967e40ce9add831f6304c27e61e3091d63c0ee2e77492ea06504a465"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/packaging/Dockerfile.ubuntu-dev"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `node:18.7.0` not pinned by digest"}, "properties": {"repobilityId": 224146, "scanner": "repobility-supply-chain", "fingerprint": "38f61141460dface1d0c50dbea84284690e7d27f2a6fbd250f6b5c25ad596cb3", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|38f61141460dface1d0c50dbea84284690e7d27f2a6fbd250f6b5c25ad596cb3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/node-redis.Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `maven:3.8.6-jdk-11` not pinned by digest"}, "properties": {"repobilityId": 224145, "scanner": "repobility-supply-chain", "fingerprint": "ab7d1d147d70bac23261e3a481cad4353e2b6eebfc459f4466d21d6669a0a48d", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ab7d1d147d70bac23261e3a481cad4353e2b6eebfc459f4466d21d6669a0a48d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/jedis.Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `linuxmintd/mint21.2-amd64 (no tag)` not pinned by digest"}, "properties": {"repobilityId": 224144, "scanner": "repobility-supply-chain", "fingerprint": "77f9f4ba49d9a568ca2fe1c3f517784bd1faab596dd30e986dee3bb7bf578544", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|77f9f4ba49d9a568ca2fe1c3f517784bd1faab596dd30e986dee3bb7bf578544"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/relay.Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `golang:1.20` not pinned by digest"}, "properties": {"repobilityId": 224143, "scanner": "repobility-supply-chain", "fingerprint": "0e9ae1ad6014b8a8e90c109a457819179ec17a1527e6d7ca45834f1f3b3b9d60", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0e9ae1ad6014b8a8e90c109a457819179ec17a1527e6d7ca45834f1f3b3b9d60"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/pascaldekloe.Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `node:18.7.0` not pinned by digest"}, "properties": {"repobilityId": 224142, "scanner": "repobility-supply-chain", "fingerprint": "e4f41d7241d68b73a1cc2be59af3f5d3edfbfc918cef48dc828335c54d23877f", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e4f41d7241d68b73a1cc2be59af3f5d3edfbfc918cef48dc828335c54d23877f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/ioredis.Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "pre-commit hook `https://github.com/psf/black` pinned to mutable rev `25.1.0`"}, "properties": {"repobilityId": 224140, "scanner": "repobility-supply-chain", "fingerprint": "bd98599c799ffa100d15fae764d3fd1c1d3771bf771a18be1567196f9e3244de", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|bd98599c799ffa100d15fae764d3fd1c1d3771bf771a18be1567196f9e3244de"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 41}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "pre-commit hook `https://github.com/pre-commit/mirrors-clang-format` pinned to mutable rev `v14.0.6`"}, "properties": {"repobilityId": 224139, "scanner": "repobility-supply-chain", "fingerprint": "50564bcdf4c5784ef4df59b4145e0f042fb356d29a670bf6ccca793ea1e0b173", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|50564bcdf4c5784ef4df59b4145e0f042fb356d29a670bf6ccca793ea1e0b173"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "pre-commit hook `https://github.com/pre-commit/pre-commit-hooks` pinned to mutable rev `v4.3.0`"}, "properties": {"repobilityId": 224138, "scanner": "repobility-supply-chain", "fingerprint": "be465751b23b11f89bfc8c7d959f6de237431c5354cc15acbd8641e03d04c7bc", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|be465751b23b11f89bfc8c7d959f6de237431c5354cc15acbd8641e03d04c7bc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 28}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.replication_groups` used but never assigned in __init__"}, "properties": {"repobilityId": 224134, "scanner": "repobility-ast-engine", "fingerprint": "e0facae49cf82aa9fcb7d1a4fb4cec6a03def0c0af62d24fcd1ec6b014d03495", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e0facae49cf82aa9fcb7d1a4fb4cec6a03def0c0af62d24fcd1ec6b014d03495"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 334}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.replication_groups` used but never assigned in __init__"}, "properties": {"repobilityId": 224133, "scanner": "repobility-ast-engine", "fingerprint": "1e66912f2d8b3108e2c5e87804ced4c8c9d962e333c33a9d23a3f6f7e1d95c2b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1e66912f2d8b3108e2c5e87804ced4c8c9d962e333c33a9d23a3f6f7e1d95c2b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 331}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.nodes` used but never assigned in __init__"}, "properties": {"repobilityId": 224132, "scanner": "repobility-ast-engine", "fingerprint": "7d35dda1146e3ef08a1ceaf25d06a31352b25d72e57c1a0bf5d440f885c99fec", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7d35dda1146e3ef08a1ceaf25d06a31352b25d72e57c1a0bf5d440f885c99fec"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 324}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.replication_groups` used but never assigned in __init__"}, "properties": {"repobilityId": 224131, "scanner": "repobility-ast-engine", "fingerprint": "e2b2eb011d93336929fb7b24e41a3b2c67bc3eac8282fe49996c871b0f202de6", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e2b2eb011d93336929fb7b24e41a3b2c67bc3eac8282fe49996c871b0f202de6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 323}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224130, "scanner": "repobility-ast-engine", "fingerprint": "2d20b8ec2d29a16fc113bb935d920257608919eecd47b43850b9410199333279", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2d20b8ec2d29a16fc113bb935d920257608919eecd47b43850b9410199333279"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 264}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224129, "scanner": "repobility-ast-engine", "fingerprint": "0c9d71fc8604ed125b245714df27bc8a6625aa60cfbeb4435ffff81b9188edbd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0c9d71fc8604ed125b245714df27bc8a6625aa60cfbeb4435ffff81b9188edbd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 261}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224128, "scanner": "repobility-ast-engine", "fingerprint": "b705c9e5f4439f0f670e23bde96f63415848357a721bf55bc1ba882c98e0c69f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b705c9e5f4439f0f670e23bde96f63415848357a721bf55bc1ba882c98e0c69f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 255}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224127, "scanner": "repobility-ast-engine", "fingerprint": "861a03d28b499c4dac5ed1bf116b7d0f4615641a140fa2d0683d0c6fd39e046c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|861a03d28b499c4dac5ed1bf116b7d0f4615641a140fa2d0683d0c6fd39e046c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 258}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224126, "scanner": "repobility-ast-engine", "fingerprint": "88bbccfe061bd636ba1dd07ca433969ba0a7c8d9f7b8ebc6b176f9d77a6ff0de", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|88bbccfe061bd636ba1dd07ca433969ba0a7c8d9f7b8ebc6b176f9d77a6ff0de"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 254}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224125, "scanner": "repobility-ast-engine", "fingerprint": "32ef2941afc721d19e25b040c9330c89bff592f93e7bd1450101097b3c4778fb", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|32ef2941afc721d19e25b040c9330c89bff592f93e7bd1450101097b3c4778fb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 253}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.client` used but never assigned in __init__"}, "properties": {"repobilityId": 224124, "scanner": "repobility-ast-engine", "fingerprint": "2e060e24c4c41f14376d3df96ec99e91b2ba00dca471fbcd5ae2552059c7a0ab", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2e060e24c4c41f14376d3df96ec99e91b2ba00dca471fbcd5ae2552059c7a0ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224123, "scanner": "repobility-ast-engine", "fingerprint": "b8db0eeb0d21ab02d757ae5904fe23cc803a7f08a49333bcef514a5e8a565755", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b8db0eeb0d21ab02d757ae5904fe23cc803a7f08a49333bcef514a5e8a565755"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 201}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224122, "scanner": "repobility-ast-engine", "fingerprint": "337ca0941db23f1ca04f4fd1642b1b14ef4f00a3bc95d65faf4bdc1270dd2898", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|337ca0941db23f1ca04f4fd1642b1b14ef4f00a3bc95d65faf4bdc1270dd2898"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 205}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224121, "scanner": "repobility-ast-engine", "fingerprint": "9812c013e663535fcf9384d0af880df10f005b36c34e787c706db1793b01f0ae", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9812c013e663535fcf9384d0af880df10f005b36c34e787c706db1793b01f0ae"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 204}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224120, "scanner": "repobility-ast-engine", "fingerprint": "90ba3b1121094d2abfec11c20968aa696b24f200794d4143f97b702f7f92da31", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|90ba3b1121094d2abfec11c20968aa696b24f200794d4143f97b702f7f92da31"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 203}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.nodes` used but never assigned in __init__"}, "properties": {"repobilityId": 224119, "scanner": "repobility-ast-engine", "fingerprint": "4e7736e6cfe6ffd924287c19fb453c63c30a1e806dcb407d2e34883eb30551ee", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4e7736e6cfe6ffd924287c19fb453c63c30a1e806dcb407d2e34883eb30551ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 205}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.client` used but never assigned in __init__"}, "properties": {"repobilityId": 224118, "scanner": "repobility-ast-engine", "fingerprint": "03c6bd3c02eab6de8437f32d3b041356968f621cdb8fce0ef2d977a2a28838a3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|03c6bd3c02eab6de8437f32d3b041356968f621cdb8fce0ef2d977a2a28838a3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 204}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.server` used but never assigned in __init__"}, "properties": {"repobilityId": 224117, "scanner": "repobility-ast-engine", "fingerprint": "5163c349cbe7a65eec30faa2ba3345efb12024434d9613b4e0c2ac7cfafcd88e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5163c349cbe7a65eec30faa2ba3345efb12024434d9613b4e0c2ac7cfafcd88e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 203}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.rg` used but never assigned in __init__"}, "properties": {"repobilityId": 224116, "scanner": "repobility-ast-engine", "fingerprint": "293a39b4777589ed3a83daa89a13610976421d48f87fa9b43062b2322ccb322d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|293a39b4777589ed3a83daa89a13610976421d48f87fa9b43062b2322ccb322d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/valkey_search/valkey_search_test_case_dragonfly.py"}, "region": {"startLine": 197}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_standard_benchmark"}, "properties": {"repobilityId": 224105, "scanner": "repobility-ast-engine", "fingerprint": "f7179d4a9b908218720efc63817b97ab32712bbf8a332870adff6019c4a9ca9a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f7179d4a9b908218720efc63817b97ab32712bbf8a332870adff6019c4a9ca9a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/search_benchmark_test.py"}, "region": {"startLine": 159}}}]}, {"ruleId": "MINED110", "level": "error", "message": {"text": "Blocking call `time.sleep` inside async function `test_heartbeat_eviction_propagation`"}, "properties": {"repobilityId": 224098, "scanner": "repobility-ast-engine", "fingerprint": "b3b70d66914c8135bc3f8182ea072884a25ec7feff4f0e3a816ddbcb5979ff53", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "asyncio-blocking-call", "owasp": null, "cwe_ids": ["CWE-833"], "languages": ["python"], "observations_count": 31606}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b3b70d66914c8135bc3f8182ea072884a25ec7feff4f0e3a816ddbcb5979ff53"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 2305}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_hnsw_external_vector_replication_crash"}, "properties": {"repobilityId": 224097, "scanner": "repobility-ast-engine", "fingerprint": "2804b5e9ded5a0d37e8357cbc05b8e73f95d8873c7a0ea6593ab3c323a0a5b03", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2804b5e9ded5a0d37e8357cbc05b8e73f95d8873c7a0ea6593ab3c323a0a5b03"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 4707}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_hnsw_search_replication_with_network_disruptions"}, "properties": {"repobilityId": 224096, "scanner": "repobility-ast-engine", "fingerprint": "db8aefb28dea43aa9b51d56e5889d3735bf05cd6005760310feb456301df1d40", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|db8aefb28dea43aa9b51d56e5889d3735bf05cd6005760310feb456301df1d40"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 4403}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_bug_in_json_memory_tracking"}, "properties": {"repobilityId": 224095, "scanner": "repobility-ast-engine", "fingerprint": "97c9a8f2a82695e0079c8a1dd34ff77d8a769a4768ebaf8feabdb583e611c27e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|97c9a8f2a82695e0079c8a1dd34ff77d8a769a4768ebaf8feabdb583e611c27e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 3294}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_preempt_in_atomic_section_of_heartbeat"}, "properties": {"repobilityId": 224094, "scanner": "repobility-ast-engine", "fingerprint": "661a0f213e8d6e0faa9e9a892257c3cfe76813822e2d62dbb89a5bd98d3dc8bf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|661a0f213e8d6e0faa9e9a892257c3cfe76813822e2d62dbb89a5bd98d3dc8bf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 3264}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_replication_timeout_on_full_sync"}, "properties": {"repobilityId": 224093, "scanner": "repobility-ast-engine", "fingerprint": "440c800872c94fd05cbc33891d58459ca6a7fcb0c1fdbb5b6e67b2c8e3b61a97", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|440c800872c94fd05cbc33891d58459ca6a7fcb0c1fdbb5b6e67b2c8e3b61a97"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 2571}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_replication_list_double_apply"}, "properties": {"repobilityId": 224092, "scanner": "repobility-ast-engine", "fingerprint": "236972ee8587576973a271782a7cec85b04d4e52e7c9f49267e32177b707accf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|236972ee8587576973a271782a7cec85b04d4e52e7c9f49267e32177b707accf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/replication_test.py"}, "region": {"startLine": 320}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.sed_thread` used but never assigned in __init__"}, "properties": {"repobilityId": 224091, "scanner": "repobility-ast-engine", "fingerprint": "43acc72639a03fdaaf5e5af292cb94a61c8d0a5c9423eae02715511db368abd1", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|43acc72639a03fdaaf5e5af292cb94a61c8d0a5c9423eae02715511db368abd1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/instance.py"}, "region": {"startLine": 266}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.stacktrace` used but never assigned in __init__"}, "properties": {"repobilityId": 224090, "scanner": "repobility-ast-engine", "fingerprint": "e9e80d67424289f68a5d211fcb53f1a870c9baa171de73f292f11efdba6b88d4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e9e80d67424289f68a5d211fcb53f1a870c9baa171de73f292f11efdba6b88d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/instance.py"}, "region": {"startLine": 267}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.stacktrace` used but never assigned in __init__"}, "properties": {"repobilityId": 224089, "scanner": "repobility-ast-engine", "fingerprint": "7346f1169a1193a5ba96c3d83d8ba5c0b837ecc546109f1017fb5996df2648ea", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7346f1169a1193a5ba96c3d83d8ba5c0b837ecc546109f1017fb5996df2648ea"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/instance.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.sed_thread` used but never assigned in __init__"}, "properties": {"repobilityId": 224088, "scanner": "repobility-ast-engine", "fingerprint": "f5e967aa430e901344d7ee214edefd6e81e4dce9291c07c73e6f81c252296567", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f5e967aa430e901344d7ee214edefd6e81e4dce9291c07c73e6f81c252296567"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/instance.py"}, "region": {"startLine": 222}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.sed_thread` used but never assigned in __init__"}, "properties": {"repobilityId": 224087, "scanner": "repobility-ast-engine", "fingerprint": "aac07f3ae3d716bee485d833da4929eee3c84484120e80f5a9f1d70a1a2d2b7d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|aac07f3ae3d716bee485d833da4929eee3c84484120e80f5a9f1d70a1a2d2b7d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/instance.py"}, "region": {"startLine": 219}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.stacktrace` used but never assigned in __init__"}, "properties": {"repobilityId": 224086, "scanner": "repobility-ast-engine", "fingerprint": "80d8b14762ba60622d92c799a867bbfbc8c217bfc188d67c112c2182ebb57d9f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|80d8b14762ba60622d92c799a867bbfbc8c217bfc188d67c112c2182ebb57d9f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/instance.py"}, "region": {"startLine": 218}}}]}, {"ruleId": "MINED110", "level": "error", "message": {"text": "Blocking call `time.sleep` inside async function `test_blocking_command_close_eof`"}, "properties": {"repobilityId": 224082, "scanner": "repobility-ast-engine", "fingerprint": "4b870f78f058c4886544425166c212e910d8991d4fb573ff9259766a3a0857c2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "asyncio-blocking-call", "owasp": null, "cwe_ids": ["CWE-833"], "languages": ["python"], "observations_count": 31606}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4b870f78f058c4886544425166c212e910d8991d4fb573ff9259766a3a0857c2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 2364}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_client_detached_crash"}, "properties": {"repobilityId": 224081, "scanner": "repobility-ast-engine", "fingerprint": "c2b84ddb5c8a891c635e6ebc4be276ec382d795ee38919decc105a164434b685", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c2b84ddb5c8a891c635e6ebc4be276ec382d795ee38919decc105a164434b685"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 1631}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_client_pause_b2b"}, "properties": {"repobilityId": 224080, "scanner": "repobility-ast-engine", "fingerprint": "7efb2b9e77400f51b59c491699702b3ebd4f19f75f6c54de5668dec4867a6b94", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7efb2b9e77400f51b59c491699702b3ebd4f19f75f6c54de5668dec4867a6b94"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 1616}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_hiredis"}, "properties": {"repobilityId": 224079, "scanner": "repobility-ast-engine", "fingerprint": "5d6afa46d67270b305b4916a71fdf7a0868cffe6baf242a82786313664dde629", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5d6afa46d67270b305b4916a71fdf7a0868cffe6baf242a82786313664dde629"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 1260}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_squashed_pipeline_multi"}, "properties": {"repobilityId": 224078, "scanner": "repobility-ast-engine", "fingerprint": "63568d3e450020be1f01be144dccfcbe9c44e55ea78cbcb9bbead293f7b9a014", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|63568d3e450020be1f01be144dccfcbe9c44e55ea78cbcb9bbead293f7b9a014"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 1059}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_squashed_pipeline_seeder"}, "properties": {"repobilityId": 224077, "scanner": "repobility-ast-engine", "fingerprint": "e92f503d957ee4d924960c30e9dba491a29013676b9926e0ef12f2b7998a6fa9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e92f503d957ee4d924960c30e9dba491a29013676b9926e0ef12f2b7998a6fa9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 1048}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_pipeline_batching_while_migrating"}, "properties": {"repobilityId": 224076, "scanner": "repobility-ast-engine", "fingerprint": "5ea480f7d36aed94fc5654adfc137a82d4831a303379905ad741f65a0a2d891c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5ea480f7d36aed94fc5654adfc137a82d4831a303379905ad741f65a0a2d891c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 908}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_parser_while_script_running"}, "properties": {"repobilityId": 224075, "scanner": "repobility-ast-engine", "fingerprint": "791a3e260076662e69f5cf254f47c8ef2073fea7294baa1740d04f12a830c38c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|791a3e260076662e69f5cf254f47c8ef2073fea7294baa1740d04f12a830c38c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 873}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_match_http"}, "properties": {"repobilityId": 224074, "scanner": "repobility-ast-engine", "fingerprint": "7ba3dc07c8baf584d1807890decca1c1c25cc8501357cab7239e5627c6c79518", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7ba3dc07c8baf584d1807890decca1c1c25cc8501357cab7239e5627c6c79518"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 833}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_subscribe_pipelined"}, "properties": {"repobilityId": 224073, "scanner": "repobility-ast-engine", "fingerprint": "b5ce6b903041bbce96624b64e428b58e2ec1d0f7a41367708232e09b18635c7f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b5ce6b903041bbce96624b64e428b58e2ec1d0f7a41367708232e09b18635c7f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 786}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_subscribers_with_active_publisher"}, "properties": {"repobilityId": 224072, "scanner": "repobility-ast-engine", "fingerprint": "ee93b88a6b3648728b241bb3ae09e42a7dad7ccf3af777bacde58e75c9fb9be4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ee93b88a6b3648728b241bb3ae09e42a7dad7ccf3af777bacde58e75c9fb9be4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 514}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_pubsub_busy_connections"}, "properties": {"repobilityId": 224071, "scanner": "repobility-ast-engine", "fingerprint": "c1a42366d44bd0e147fb3793d7e9c37d8547da11dcbd4f6dd311f7905ae1f14b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c1a42366d44bd0e147fb3793d7e9c37d8547da11dcbd4f6dd311f7905ae1f14b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/connection_test.py"}, "region": {"startLine": 467}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_blpop_multiple_keys"}, "properties": {"repobilityId": 224066, "scanner": "repobility-ast-engine", "fingerprint": "c8a9ba3e9e5bd4d661a677438aa7195066bea360b3f10be962f1d2316b286aef", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c8a9ba3e9e5bd4d661a677438aa7195066bea360b3f10be962f1d2316b286aef"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/list_family_test.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_env"}, "properties": {"repobilityId": 224064, "scanner": "repobility-ast-engine", "fingerprint": "8965d9fc68a0f82728a18b3a0b33c3b2e5a59f4ece1f41b028bd304593aeb4ce", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8965d9fc68a0f82728a18b3a0b33c3b2e5a59f4ece1f41b028bd304593aeb4ce"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/conftest.py"}, "region": {"startLine": 224}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_config_disable_tls"}, "properties": {"repobilityId": 224062, "scanner": "repobility-ast-engine", "fingerprint": "0d3f430f652729f75a41c45034c95950a720dd9cff36b1b1bb1bed030bf9da0b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0d3f430f652729f75a41c45034c95950a720dd9cff36b1b1bb1bed030bf9da0b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/tls_conf_test.py"}, "region": {"startLine": 155}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_client_tls_cert"}, "properties": {"repobilityId": 224061, "scanner": "repobility-ast-engine", "fingerprint": "5d6d47ebec73fd2df0d272d97bb887bc45327a6e6ac409bccfcd2aa4279a50e4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5d6d47ebec73fd2df0d272d97bb887bc45327a6e6ac409bccfcd2aa4279a50e4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/tls_conf_test.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_client_tls_password"}, "properties": {"repobilityId": 224060, "scanner": "repobility-ast-engine", "fingerprint": "e1b2c4033fc8445d2a69b67cb2043186a13b6c478e9038379996aede185e2359", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e1b2c4033fc8445d2a69b67cb2043186a13b6c478e9038379996aede185e2359"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/tls_conf_test.py"}, "region": {"startLine": 45}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_tls_client_certs"}, "properties": {"repobilityId": 224059, "scanner": "repobility-ast-engine", "fingerprint": "457541a623e415c6d80ab4fe4b48c34486d0ad403103827e2acff5caf29da65b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|457541a623e415c6d80ab4fe4b48c34486d0ad403103827e2acff5caf29da65b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/tls_conf_test.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_tls_password"}, "properties": {"repobilityId": 224058, "scanner": "repobility-ast-engine", "fingerprint": "fdf2a5afb8dccdb7d7e8aedad5d3fb666548bae7e1fbb68fe10269141fa3cfc8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|fdf2a5afb8dccdb7d7e8aedad5d3fb666548bae7e1fbb68fe10269141fa3cfc8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/tls_conf_test.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 224325, "scanner": "gitleaks", "fingerprint": "a39573048f6f26933a9a8434d8c47dc300c56f7fd53e03082a01b9254e91733b", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "key3 = \"REDACTED\"", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|42|key3 redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/test/test_mixins/test_set_commands.py"}, "region": {"startLine": 427}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 224324, "scanner": "gitleaks", "fingerprint": "21ca4d97c00b63c59dbf73e433fac1967fb43ceb82317b98b7b81c828a0aa697", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "key2 = \"REDACTED\"", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|42|key2 redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/test/test_mixins/test_set_commands.py"}, "region": {"startLine": 426}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 224323, "scanner": "gitleaks", "fingerprint": "ec7e3dd47818f597f40ffb8b87e14c3bb4b948ce67de5f6e5fb9138a48bc5b74", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "key1 = \"REDACTED\"", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|42|key1 redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/test/test_mixins/test_set_commands.py"}, "region": {"startLine": 425}}}]}, {"ruleId": "private-key", "level": "error", "message": {"text": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption."}, "properties": {"repobilityId": 224322, "scanner": "gitleaks", "fingerprint": "6a5990f3f1ee6106a5da3b8d3e1d98c77bf90536c173d942b01402451b359e0d", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "REDACTED", "rule_id": "private-key", "scanner": "gitleaks", "detector": "private-key", "correlation_key": "secret|token|3|redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/ci/tls-values.golden.yaml"}, "region": {"startLine": 36}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 224321, "scanner": "gitleaks", "fingerprint": "10213a8ef777ef717fa6adcd1642d913dbfaf3e4d2abea278e5627278a0d1031", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "tls-secret: <redacted>", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|7|tls-secret: redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/ci/tls-values.golden.yaml"}, "region": {"startLine": 80}}}]}, {"ruleId": "kubernetes-secret-yaml", "level": "error", "message": {"text": "Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments"}, "properties": {"repobilityId": 224320, "scanner": "gitleaks", "fingerprint": "7c477fe672122ff7cf85b534fce2b2a28c57842a50ef23a2bc20fd2139c85873", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "kind: Secret\n  metadata:\n    name: dfly-password\n  stringData:\n    password: <redacted>\n- apiVersion: v1\n  kind: ConfigMap\n  metadata:\n    name: my-configmap\n  data:\n    REDACTED", "rule_id": "kubernetes-secret-yaml", "scanner": "gitleaks", "detector": "kubernetes-secret-yaml", "correlation_key": "secret|token|1|kind: secret metadata: name: dfly-password stringdata: password: redacted - apiversion: v1 kind: configmap metadata: nam"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/ci/extraenv-and-passwordSecret-values.yaml"}, "region": {"startLine": 3}}}]}, {"ruleId": "private-key", "level": "error", "message": {"text": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption."}, "properties": {"repobilityId": 224319, "scanner": "gitleaks", "fingerprint": "eb05185d2d215a5fcae36b9e97d3a66eace95b5b7eb21ccee991698686db4882", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "REDACTED", "rule_id": "private-key", "scanner": "gitleaks", "detector": "private-key", "correlation_key": "secret|token|13|redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/values.yaml"}, "region": {"startLine": 133}}}]}, {"ruleId": "private-key", "level": "error", "message": {"text": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption."}, "properties": {"repobilityId": 224318, "scanner": "gitleaks", "fingerprint": "4c607e3b32702f7b8fdf8e0a17cbbf42c415e8de5eced2bd248c2c282e891a6a", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "REDACTED", "rule_id": "private-key", "scanner": "gitleaks", "detector": "private-key", "correlation_key": "secret|token|1|redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/ci/tls-values.yaml"}, "region": {"startLine": 20}}}]}, {"ruleId": "kubernetes-secret-yaml", "level": "error", "message": {"text": "Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments"}, "properties": {"repobilityId": 224317, "scanner": "gitleaks", "fingerprint": "609d6aa66c3fd9a573750457e6461bfb2fcc075966fca76b6c810165119e654d", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "data:\n    REDACTED\n    configKey2: configValue2\n- apiVersion: v1\n  kind: Secret", "rule_id": "kubernetes-secret-yaml", "scanner": "gitleaks", "detector": "kubernetes-secret-yaml", "correlation_key": "secret|token|1|data: redacted configkey2: configvalue2 - apiversion: v1 kind: secret"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "contrib/charts/dragonfly/ci/extraenv-values.yaml"}, "region": {"startLine": 6}}}]}, {"ruleId": "MINED022", "level": "error", "message": {"text": "[MINED022] C Strcpy: strcpy/strcat dont bounds-check; use strncpy or snprintf."}, "properties": {"repobilityId": 224249, "scanner": "repobility-threat-engine", "fingerprint": "cadd5ad615f5cfd2d308af059dea514a40ab52262f6f97854a4888339cc107db", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "c-strcpy", "owasp": null, "cwe_ids": ["CWE-120"], "languages": ["c", "cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347949+00:00", "triaged_in_corpus": 20, "observations_count": 39114, "ai_coder_pattern_id": 130}, "scanner": "repobility-threat-engine", "correlation_key": "fp|cadd5ad615f5cfd2d308af059dea514a40ab52262f6f97854a4888339cc107db"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/collection_entry.h"}, "region": {"startLine": 31}}}]}, {"ruleId": "MINED022", "level": "error", "message": {"text": "[MINED022] C Strcpy: strcpy/strcat dont bounds-check; use strncpy or snprintf."}, "properties": {"repobilityId": 224248, "scanner": "repobility-threat-engine", "fingerprint": "76c642246eccd08206e5cd2fae544b75eb24a10581875f658b12160b1e8a5a6a", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "c-strcpy", "owasp": null, "cwe_ids": ["CWE-120"], "languages": ["c", "cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347949+00:00", "triaged_in_corpus": 20, "observations_count": 39114, "ai_coder_pattern_id": 130}, "scanner": "repobility-threat-engine", "correlation_key": "fp|76c642246eccd08206e5cd2fae544b75eb24a10581875f658b12160b1e8a5a6a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/cms_test.cc"}, "region": {"startLine": 90}}}]}, {"ruleId": "MINED022", "level": "error", "message": {"text": "[MINED022] C Strcpy: strcpy/strcat dont bounds-check; use strncpy or snprintf."}, "properties": {"repobilityId": 224247, "scanner": "repobility-threat-engine", "fingerprint": "903ec1d01e01013335751a72dd8c225494789bae79d325a188a5d851b00d7b3d", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "c-strcpy", "owasp": null, "cwe_ids": ["CWE-120"], "languages": ["c", "cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347949+00:00", "triaged_in_corpus": 20, "observations_count": 39114, "ai_coder_pattern_id": 130}, "scanner": "repobility-threat-engine", "correlation_key": "fp|903ec1d01e01013335751a72dd8c225494789bae79d325a188a5d851b00d7b3d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/bloom_test.cc"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `queue` used but not imported"}, "properties": {"repobilityId": 224135, "scanner": "repobility-ast-engine", "fingerprint": "b2ad3066ad76ec6fbb86b4a74b293538dbd4ed01fcd24e43ae11449471076dcc", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b2ad3066ad76ec6fbb86b4a74b293538dbd4ed01fcd24e43ae11449471076dcc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fakeredis/test/test_asyncredis.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `logging` used but not imported"}, "properties": {"repobilityId": 224113, "scanner": "repobility-ast-engine", "fingerprint": "9807272ee52d97c1effe3ec04a6be94ce452ffe09ddd7290a7403b5cc97b723f", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9807272ee52d97c1effe3ec04a6be94ce452ffe09ddd7290a7403b5cc97b723f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/cluster_mgr_test.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `time` used but not imported"}, "properties": {"repobilityId": 224112, "scanner": "repobility-ast-engine", "fingerprint": "11980221c3a8d22dccfd6e47cc06391fa3acee18489ffa4fedb6746d7ec9e52d", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|11980221c3a8d22dccfd6e47cc06391fa3acee18489ffa4fedb6746d7ec9e52d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/acl_family_test.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `os` used but not imported"}, "properties": {"repobilityId": 224111, "scanner": "repobility-ast-engine", "fingerprint": "e96f54657e3f35b9033e60767195d6999b74f946edb9beafa034070327eeede0", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e96f54657e3f35b9033e60767195d6999b74f946edb9beafa034070327eeede0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/acl_family_test.py"}, "region": {"startLine": 318}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `logging` used but not imported"}, "properties": {"repobilityId": 224110, "scanner": "repobility-ast-engine", "fingerprint": "2a2ba08fe7e5ba5f6b77a67e0d06a2bd744feff5ebd687dd9c57205b181cb30c", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2a2ba08fe7e5ba5f6b77a67e0d06a2bd744feff5ebd687dd9c57205b181cb30c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/acl_family_test.py"}, "region": {"startLine": 682}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `asyncio` used but not imported"}, "properties": {"repobilityId": 224109, "scanner": "repobility-ast-engine", "fingerprint": "2b2dd562be691eb9721e5b33794b6f2435f20adb40af2b31b0b72b44aa718a62", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2b2dd562be691eb9721e5b33794b6f2435f20adb40af2b31b0b72b44aa718a62"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/acl_family_test.py"}, "region": {"startLine": 271}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `subprocess` used but not imported"}, "properties": {"repobilityId": 224108, "scanner": "repobility-ast-engine", "fingerprint": "5dd4c0b5d713f21cfc8f36cbda80717a552f6eef63eb763c3e3f988638e1a41b", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5dd4c0b5d713f21cfc8f36cbda80717a552f6eef63eb763c3e3f988638e1a41b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/server_family_test.py"}, "region": {"startLine": 280}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `logging` used but not imported"}, "properties": {"repobilityId": 224107, "scanner": "repobility-ast-engine", "fingerprint": "ffb0a9562c29d3876b2966c7d483d066c125e396cc887753462eda9f5a672e03", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ffb0a9562c29d3876b2966c7d483d066c125e396cc887753462eda9f5a672e03"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/server_family_test.py"}, "region": {"startLine": 128}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `string` used but not imported"}, "properties": {"repobilityId": 224104, "scanner": "repobility-ast-engine", "fingerprint": "29a613886c33573ef5f3c32308dece2cadcf7712aa047d0e3c8b909c290190e5", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|29a613886c33573ef5f3c32308dece2cadcf7712aa047d0e3c8b909c290190e5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/redis_replication_test.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `random` used but not imported"}, "properties": {"repobilityId": 224103, "scanner": "repobility-ast-engine", "fingerprint": "0687f68c2e0329da64f2268be797a84f037e1e4101bff8b5d26bf92b6777c378", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0687f68c2e0329da64f2268be797a84f037e1e4101bff8b5d26bf92b6777c378"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/redis_replication_test.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `logging` used but not imported"}, "properties": {"repobilityId": 224102, "scanner": "repobility-ast-engine", "fingerprint": "a1fbde5c3db51005855981a31169320644f4c8dbc6c8a924f1a7fe75e482c7ab", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a1fbde5c3db51005855981a31169320644f4c8dbc6c8a924f1a7fe75e482c7ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/redis_replication_test.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `queue` used but not imported"}, "properties": {"repobilityId": 224083, "scanner": "repobility-ast-engine", "fingerprint": "8b96651594fdfa01a1a32223428ebce17da0603cf5f590298c91f19d39a5bec7", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8b96651594fdfa01a1a32223428ebce17da0603cf5f590298c91f19d39a5bec7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/utility.py"}, "region": {"startLine": 740}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `time` used but not imported"}, "properties": {"repobilityId": 224069, "scanner": "repobility-ast-engine", "fingerprint": "2d84e0757edee4eccc75e5948202770309180448d7e2852fa079b3fd8cbb914e", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2d84e0757edee4eccc75e5948202770309180448d7e2852fa079b3fd8cbb914e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/search_test.py"}, "region": {"startLine": 689}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `json` used but not imported"}, "properties": {"repobilityId": 224068, "scanner": "repobility-ast-engine", "fingerprint": "e6e3b29af7fc024dbd7ac8032e3bbcc9a4c840786e4098927330dc19afd4abdb", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e6e3b29af7fc024dbd7ac8032e3bbcc9a4c840786e4098927330dc19afd4abdb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/search_test.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `asyncio` used but not imported"}, "properties": {"repobilityId": 224067, "scanner": "repobility-ast-engine", "fingerprint": "501d0631b044efeb744cf46a1635652a8f67885b71437aab0a0526e646543e29", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|501d0631b044efeb744cf46a1635652a8f67885b71437aab0a0526e646543e29"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/search_test.py"}, "region": {"startLine": 811}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `os` used but not imported"}, "properties": {"repobilityId": 224063, "scanner": "repobility-ast-engine", "fingerprint": "4695486c9499baa9409768611b81df73be85dac8361a3f4656073549a0d63fd9", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4695486c9499baa9409768611b81df73be85dac8361a3f4656073549a0d63fd9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/dragonfly/tls_conf_test.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `queue` used but not imported"}, "properties": {"repobilityId": 224056, "scanner": "repobility-ast-engine", "fingerprint": "045c387d263c888a7d2a8124bd773a5759534ff541bd6061f84d6f30a5572852", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|045c387d263c888a7d2a8124bd773a5759534ff541bd6061f84d6f30a5572852"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/defrag_db.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "2715351b20185dad", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}]}]}