{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-972db5972b9a15b5", "name": "Possibly dead Python function: update_config", "shortDescription": {"text": "Possibly dead Python function: update_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8aca231916482ecb", "name": "Possibly dead Python function: save_config", "shortDescription": {"text": "Possibly dead Python function: save_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2381c5669de30da0", "name": "Possibly dead Python function: print_config", "shortDescription": {"text": "Possibly dead Python function: print_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-372041f8e4a76518", "name": "Possibly dead Python function: reduce_tensor", "shortDescription": {"text": "Possibly dead Python function: reduce_tensor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-161c22ad2a7a24c7", "name": "Possibly dead Python function: browse_data_dir", "shortDescription": {"text": "Possibly dead Python function: browse_data_dir"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dc45de13c419122", "name": "Possibly dead Python function: browse_output_dir", "shortDescription": {"text": "Possibly dead Python function: browse_output_dir"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48c4bba63608e9db", "name": "Possibly dead Python function: reset_fields", "shortDescription": {"text": "Possibly dead Python function: reset_fields"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56d5473d28b2de06", "name": "Possibly dead Python function: start_prediction", "shortDescription": {"text": "Possibly dead Python function: start_prediction"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e574a4e072f32aa", "name": "Possibly dead Python function: run_prediction", "shortDescription": {"text": "Possibly dead Python function: run_prediction"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0694ff641499dd44", "name": "Possibly dead Python function: forward", "shortDescription": {"text": "Possibly dead Python function: forward"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5500972959a41acf", "name": "avoid pickle \u2014 finetune/dataset.py:42", "shortDescription": {"text": "avoid pickle \u2014 finetune/dataset.py:42"}, "fullDescription": {"text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\nRule: python.lang.security.deserialization.pickle.avoid-pickle\nSeverity: WARNING\nOWASP: A08:2017 - Insecure Deserialization, A08:2021 - Software and Data Integrity Failures, A08:2025 - Software or Data Integrity Failures\nCWE: CWE-502: Deserialization of Untrusted Data\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-3d2752ecbadd6bba", "name": "avoid pickle \u2014 finetune/qlib_data_preprocess.py:115", "shortDescription": {"text": "avoid pickle \u2014 finetune/qlib_data_preprocess.py:115"}, "fullDescription": {"text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\nRule: python.lang.security.deserialization.pickle.avoid-pickle\nSeverity: WARNING\nOWASP: A08:2017 - Insecure Deserialization, A08:2021 - Software and Data Integrity Failures, A08:2025 - Software or Data Integrity Failures\nCWE: CWE-502: Deserialization of Untrusted Data\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-d7eab71361598849", "name": "avoid pickle \u2014 finetune/qlib_test.py:338", "shortDescription": {"text": "avoid pickle \u2014 finetune/qlib_test.py:338"}, "fullDescription": {"text": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\nRule: python.lang.security.deserialization.pickle.avoid-pickle\nSeverity: WARNING\nOWASP: A08:2017 - Insecure Deserialization, A08:2021 - Software and Data Integrity Failures, A08:2025 - Software or Data Integrity Failures\nCWE: CWE-502: Deserialization of Untrusted Data\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-54cfb3168a8f5db7", "name": "avoid_app_run_with_bad_host \u2014 webui/app.py:708", "shortDescription": {"text": "avoid_app_run_with_bad_host \u2014 webui/app.py:708"}, "fullDescription": {"text": "Running flask app with host 0.0.0.0 could expose the server publicly.\n\nRule: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\nSeverity: WARNING\nOWASP: A01:2021 - Broken Access Control, A01:2025 - Broken Access Control\nCWE: CWE-668: Exposure of Resource to Wrong Sphere\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-6667262db3af49b7", "name": "debug enabled \u2014 webui/app.py:708", "shortDescription": {"text": "debug enabled \u2014 webui/app.py:708"}, "fullDescription": {"text": "Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\nRule: python.flask.security.audit.debug-enabled.debug-enabled\nSeverity: WARNING\nOWASP: A06:2017 - Security Misconfiguration\nCWE: CWE-489: Active Debug Code\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a559e5989bca6280", "name": "avoid_app_run_with_bad_host \u2014 webui/run.py:82", "shortDescription": {"text": "avoid_app_run_with_bad_host \u2014 webui/run.py:82"}, "fullDescription": {"text": "Running flask app with host 0.0.0.0 could expose the server publicly.\n\nRule: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\nSeverity: WARNING\nOWASP: A01:2021 - Broken Access Control, A01:2025 - Broken Access Control\nCWE: CWE-668: Exposure of Resource to Wrong Sphere\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-56feda2ea62c0896", "name": "CVE-2026-27205: flask 2.3.3 \u2014 webui/requirements.txt", "shortDescription": {"text": "CVE-2026-27205: flask 2.3.3 \u2014 webui/requirements.txt"}, "fullDescription": {"text": "flask: Flask: Information disclosure via improper caching of session data\n\nFlask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk d\n\nPackage: flask\nInstalled: 2.3.3\nFixed in: 3.1.3\nSeverity: LOW\nFix: Upgrade flask to 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e617cb4288d62efa", "name": "CVE-2024-6221: flask-cors 4.0.0 \u2014 webui/requirements.txt", "shortDescription": {"text": "CVE-2024-6221: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "fullDescription": {"text": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Ac ...\n\nA vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.\n\nPackage: flask-cors\nInstalled: 4.0.0\nFixed in: 4.0.2\nSeverity: HIGH\nFix: Upgrade flask-cors to 4.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-19795f45a7ab2984", "name": "CVE-2024-1681: flask-cors 4.0.0 \u2014 webui/requirements.txt", "shortDescription": {"text": "CVE-2024-1681: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "fullDescription": {"text": "corydolphin/flask-cors is vulnerable to log injection when the log lev ...\n\ncorydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.\n\nPackage: flask-cors\nInstalled: 4.0.0\nFixed in: 4.0.1\nSeverity: MEDIUM\nFix: Upgrade flask-cors to 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40d65ef07654f0f9", "name": "CVE-2024-6839: flask-cors 4.0.0 \u2014 webui/requirements.txt", "shortDescription": {"text": "CVE-2024-6839: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "fullDescription": {"text": "corydolphin/flask-cors version 4.0.1 contains an improper regex path m ...\n\ncorydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.\n\nPackage: flask-cors\nInstalled: 4.0.0\nFixed in: 6.0.0\nSeverity: MEDIUM\nFix: Upgrade flask-cors to 6.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5362a753f4e0bba1", "name": "CVE-2024-6844: flask-cors 4.0.0 \u2014 webui/requirements.txt", "shortDescription": {"text": "CVE-2024-6844: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "fullDescription": {"text": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inc ...\n\nA vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cau\n\nPackage: flask-cors\nInstalled: 4.0.0\nFixed in: 6.0.0\nSeverity: MEDIUM\nFix: Upgrade flask-cors to 6.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62db7aa575fecca8", "name": "CVE-2024-6866: flask-cors 4.0.0 \u2014 webui/requirements.txt", "shortDescription": {"text": "CVE-2024-6866: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "fullDescription": {"text": "corydolphin/flask-cors version 4.01 contains a vulnerability where the ...\n\ncorydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure \n\nPackage: flask-cors\nInstalled: 4.0.0\nFixed in: 6.0.0\nSeverity: MEDIUM\nFix: Upgrade flask-cors to 6.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab9b02e0d098689", "name": "Insecure pattern 'debug_true' in webui/app.py:708", "shortDescription": {"text": "Insecure pattern 'debug_true' in webui/app.py:708"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e19aac54a4073096", "name": "Insecure pattern 'debug_true' in webui/run.py:82", "shortDescription": {"text": "Insecure pattern 'debug_true' in webui/run.py:82"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1680caad34cf5cdd", "name": "Very large file: examples/prediction_new_GUI.py (1624 lines)", "shortDescription": {"text": "Very large file: examples/prediction_new_GUI.py (1624 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da5ae8d8d9b2e51d", "name": "Very large file: examples/prediction_new.py (1332 lines)", "shortDescription": {"text": "Very large file: examples/prediction_new.py (1332 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 25 src (ratio 0.16)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 650 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14b25b839fc840da", "name": "Flask mutation route `load_data` without `@login_required` \u2014 webui/app.py:341", "shortDescription": {"text": "Flask mutation route `load_data` without `@login_required` \u2014 webui/app.py:341"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f244e2855f1b367b", "name": "Flask mutation route `predict` without `@login_required` \u2014 webui/app.py:404", "shortDescription": {"text": "Flask mutation route `predict` without `@login_required` \u2014 webui/app.py:404"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc162839795f72e9", "name": "Flask mutation route `load_model` without `@login_required` \u2014 webui/app.py:626", "shortDescription": {"text": "Flask mutation route `load_model` without `@login_required` \u2014 webui/app.py:626"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12caa9b99e965b2a", "name": "Vulnerable dependency flask 2.3.3: GHSA-68rp-wp8r-4726", "shortDescription": {"text": "Vulnerable dependency flask 2.3.3: GHSA-68rp-wp8r-4726"}, "fullDescription": {"text": "OSV.dev reports `flask` at version `2.3.3` (declared in `webui/requirements.txt`) is affected by GHSA-68rp-wp8r-4726 (aka CVE-2026-27205).\n\nFlask session does not add `Vary: Cookie` header when accessed in some ways\n\nAliases: CVE-2026-27205, GHSA-68rp-wp8r-4726, PYSEC-2026-2151\nAdvisory: https://osv.dev/vulnerability/GHSA-68rp-wp8r-4726\nFix: upgrade `flask` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd16bb6763dcfe73", "name": "Vulnerable dependency flask-cors 4.0.0: GHSA-43qf-4rqw-9q2g", "shortDescription": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-43qf-4rqw-9q2g"}, "fullDescription": {"text": "OSV.dev reports `flask-cors` at version `4.0.0` (declared in `webui/requirements.txt`) is affected by GHSA-43qf-4rqw-9q2g (aka CVE-2024-6866).\n\nFlask-CORS vulnerable to Improper Handling of Case Sensitivity\n\nAliases: CVE-2024-6866, GHSA-43qf-4rqw-9q2g, PYSEC-2026-1383\nAdvisory: https://osv.dev/vulnerability/GHSA-43qf-4rqw-9q2g\nFix: upgrade `flask-cors` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cf5c40cac478896", "name": "Vulnerable dependency flask-cors 4.0.0: GHSA-7rxf-gvfg-47g4", "shortDescription": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-7rxf-gvfg-47g4"}, "fullDescription": {"text": "OSV.dev reports `flask-cors` at version `4.0.0` (declared in `webui/requirements.txt`) is affected by GHSA-7rxf-gvfg-47g4 (aka CVE-2024-6839).\n\nFlask-CORS improper regex path matching vulnerability\n\nAliases: CVE-2024-6839, GHSA-7rxf-gvfg-47g4, PYSEC-2026-1384\nAdvisory: https://osv.dev/vulnerability/GHSA-7rxf-gvfg-47g4\nFix: upgrade `flask-cors` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11b3797f00c803ab", "name": "Vulnerable dependency flask-cors 4.0.0: GHSA-84pr-m4jr-85g5", "shortDescription": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-84pr-m4jr-85g5"}, "fullDescription": {"text": "OSV.dev reports `flask-cors` at version `4.0.0` (declared in `webui/requirements.txt`) is affected by GHSA-84pr-m4jr-85g5 (aka CVE-2024-1681).\n\nflask-cors vulnerable to log injection when the log level is set to debug\n\nAliases: CVE-2024-1681, GHSA-84pr-m4jr-85g5, PYSEC-2024-271\nAdvisory: https://osv.dev/vulnerability/GHSA-84pr-m4jr-85g5\nFix: upgrade `flask-cors` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86a1e69d1ce5318f", "name": "Vulnerable dependency flask-cors 4.0.0: GHSA-8vgw-p6qm-5gr7", "shortDescription": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-8vgw-p6qm-5gr7"}, "fullDescription": {"text": "OSV.dev reports `flask-cors` at version `4.0.0` (declared in `webui/requirements.txt`) is affected by GHSA-8vgw-p6qm-5gr7 (aka CVE-2024-6844).\n\nFlask-CORS allows for inconsistent CORS matching\n\nAliases: CVE-2024-6844, GHSA-8vgw-p6qm-5gr7, PYSEC-2026-1385\nAdvisory: https://osv.dev/vulnerability/GHSA-8vgw-p6qm-5gr7\nFix: upgrade `flask-cors` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df21023010680732", "name": "Vulnerable dependency flask-cors 4.0.0: GHSA-hxwh-jpp2-84pm", "shortDescription": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-hxwh-jpp2-84pm"}, "fullDescription": {"text": "OSV.dev reports `flask-cors` at version `4.0.0` (declared in `webui/requirements.txt`) is affected by GHSA-hxwh-jpp2-84pm (aka CVE-2024-6221).\n\nFlask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default\n\nAliases: CVE-2024-6221, GHSA-hxwh-jpp2-84pm, PYSEC-2024-71\nAdvisory: https://osv.dev/vulnerability/GHSA-hxwh-jpp2-84pm\nFix: upgrade `flask-cors` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa80e9a80b6e6ea1", "name": "Dependency flask-cors is two or more major versions behind", "shortDescription": {"text": "Dependency flask-cors is two or more major versions behind"}, "fullDescription": {"text": "`flask-cors` is pinned at `4.0.0` in `webui/requirements.txt` while the latest release on the pypi registry is `6.0.5` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `flask-cors` to `6.0.5`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7751df3f90790acd", "name": "Dependency flask is a major version behind", "shortDescription": {"text": "Dependency flask is a major version behind"}, "fullDescription": {"text": "`flask` is pinned at `2.3.3` in `webui/requirements.txt` while the latest release on the pypi registry is `3.1.3` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `flask` to `3.1.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-e5980678dac1ea93", "name": "Dependency huggingface_hub is a major version behind", "shortDescription": {"text": "Dependency huggingface_hub is a major version behind"}, "fullDescription": {"text": "`huggingface_hub` is pinned at `0.33.1` in `requirements.txt` while the latest release on the pypi registry is `1.24.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `huggingface_hub` to `1.24.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-6d77d0f592c65df8", "name": "Dependency pandas is a major version behind", "shortDescription": {"text": "Dependency pandas is a major version behind"}, "fullDescription": {"text": "`pandas` is pinned at `2.2.2` in `requirements.txt` while the latest release on the pypi registry is `3.0.5` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `pandas` to `3.0.5`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-837cacf0faaad05c", "name": "Dependency plotly is a major version behind", "shortDescription": {"text": "Dependency plotly is a major version behind"}, "fullDescription": {"text": "`plotly` is pinned at `5.17.0` in `webui/requirements.txt` while the latest release on the pypi registry is `6.9.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `plotly` to `6.9.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30746"}, "properties": {"repository": "shiyu-coder/Kronos", "repoUrl": "https://github.com/shiyu-coder/Kronos", "branch": "main"}, "results": [{"ruleId": "scanner-972db5972b9a15b5", "level": "note", "message": {"text": "Possibly dead Python function: update_config"}, "properties": {"repobilityId": "c48f39196bc407f4", "scanner": "scanner-primary", "fingerprint": "972db5972b9a15b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune_csv/config_loader.py:81"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8aca231916482ecb", "level": "note", "message": {"text": "Possibly dead Python function: save_config"}, "properties": {"repobilityId": "05435b1f9488340d", "scanner": "scanner-primary", "fingerprint": "8aca231916482ecb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune_csv/config_loader.py:93"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2381c5669de30da0", "level": "note", "message": {"text": "Possibly dead Python function: print_config"}, "properties": {"repobilityId": "7e693503f0352a1e", "scanner": "scanner-primary", "fingerprint": "2381c5669de30da0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune_csv/config_loader.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-372041f8e4a76518", "level": "note", "message": {"text": "Possibly dead Python function: reduce_tensor"}, "properties": {"repobilityId": "ba8bb54549754dc9", "scanner": "scanner-primary", "fingerprint": "372041f8e4a76518", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune/utils/training_utils.py:83"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-161c22ad2a7a24c7", "level": "note", "message": {"text": "Possibly dead Python function: browse_data_dir"}, "properties": {"repobilityId": "36483b06e31ae764", "scanner": "scanner-primary", "fingerprint": "161c22ad2a7a24c7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/prediction_new_GUI.py:210"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8dc45de13c419122", "level": "note", "message": {"text": "Possibly dead Python function: browse_output_dir"}, "properties": {"repobilityId": "f317999baa742b26", "scanner": "scanner-primary", "fingerprint": "8dc45de13c419122", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/prediction_new_GUI.py:216"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48c4bba63608e9db", "level": "note", "message": {"text": "Possibly dead Python function: reset_fields"}, "properties": {"repobilityId": "3c25aac910aec3b9", "scanner": "scanner-primary", "fingerprint": "48c4bba63608e9db", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/prediction_new_GUI.py:222"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56d5473d28b2de06", "level": "note", "message": {"text": "Possibly dead Python function: start_prediction"}, "properties": {"repobilityId": "1ee90d76dad8e57a", "scanner": "scanner-primary", "fingerprint": "56d5473d28b2de06", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/prediction_new_GUI.py:233"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e574a4e072f32aa", "level": "note", "message": {"text": "Possibly dead Python function: run_prediction"}, "properties": {"repobilityId": "4474c21a0cb34715", "scanner": "scanner-primary", "fingerprint": "1e574a4e072f32aa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/prediction_new_GUI.py:283"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0694ff641499dd44", "level": "note", "message": {"text": "Possibly dead Python function: forward"}, "properties": {"repobilityId": "ea414cce7f8e5874", "scanner": "scanner-primary", "fingerprint": "0694ff641499dd44", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "model/kronos.py:239"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5500972959a41acf", "level": "warning", "message": {"text": "avoid pickle \u2014 finetune/dataset.py:42"}, "properties": {"repobilityId": "beeed717c58c92a9", "scanner": "scanner-primary", "fingerprint": "5500972959a41acf", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune/dataset.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-3d2752ecbadd6bba", "level": "warning", "message": {"text": "avoid pickle \u2014 finetune/qlib_data_preprocess.py:115"}, "properties": {"repobilityId": "059053324aa5b5ad", "scanner": "scanner-primary", "fingerprint": "3d2752ecbadd6bba", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune/qlib_data_preprocess.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-d7eab71361598849", "level": "warning", "message": {"text": "avoid pickle \u2014 finetune/qlib_test.py:338"}, "properties": {"repobilityId": "a40aac0dad0e0007", "scanner": "scanner-primary", "fingerprint": "d7eab71361598849", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "finetune/qlib_test.py"}, "region": {"startLine": 338}}}]}, {"ruleId": "scanner-54cfb3168a8f5db7", "level": "warning", "message": {"text": "avoid_app_run_with_bad_host \u2014 webui/app.py:708"}, "properties": {"repobilityId": "3ae5b603a121c70c", "scanner": "scanner-primary", "fingerprint": "54cfb3168a8f5db7", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "flask"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/app.py"}, "region": {"startLine": 708}}}]}, {"ruleId": "scanner-6667262db3af49b7", "level": "warning", "message": {"text": "debug enabled \u2014 webui/app.py:708"}, "properties": {"repobilityId": "5ef109757c2cb862", "scanner": "scanner-primary", "fingerprint": "6667262db3af49b7", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "flask"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/app.py"}, "region": {"startLine": 708}}}]}, {"ruleId": "scanner-a559e5989bca6280", "level": "warning", "message": {"text": "avoid_app_run_with_bad_host \u2014 webui/run.py:82"}, "properties": {"repobilityId": "b946c4749993f2d6", "scanner": "scanner-primary", "fingerprint": "a559e5989bca6280", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "flask"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/run.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-56feda2ea62c0896", "level": "note", "message": {"text": "CVE-2026-27205: flask 2.3.3 \u2014 webui/requirements.txt"}, "properties": {"repobilityId": "59c34e078a85d4cc", "scanner": "scanner-primary", "fingerprint": "56feda2ea62c0896", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27205"]}}, {"ruleId": "scanner-e617cb4288d62efa", "level": "error", "message": {"text": "CVE-2024-6221: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "properties": {"repobilityId": "028e0a566003b5e5", "scanner": "scanner-primary", "fingerprint": "e617cb4288d62efa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-6221"]}}, {"ruleId": "scanner-19795f45a7ab2984", "level": "warning", "message": {"text": "CVE-2024-1681: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "properties": {"repobilityId": "d305d232bf1c08e5", "scanner": "scanner-primary", "fingerprint": "19795f45a7ab2984", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-1681"]}}, {"ruleId": "scanner-40d65ef07654f0f9", "level": "warning", "message": {"text": "CVE-2024-6839: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "properties": {"repobilityId": "908f6c0533b4375e", "scanner": "scanner-primary", "fingerprint": "40d65ef07654f0f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-6839"]}}, {"ruleId": "scanner-5362a753f4e0bba1", "level": "warning", "message": {"text": "CVE-2024-6844: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "properties": {"repobilityId": "372d6aabde743efe", "scanner": "scanner-primary", "fingerprint": "5362a753f4e0bba1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-6844"]}}, {"ruleId": "scanner-62db7aa575fecca8", "level": "warning", "message": {"text": "CVE-2024-6866: flask-cors 4.0.0 \u2014 webui/requirements.txt"}, "properties": {"repobilityId": "1f8dac433fd197ae", "scanner": "scanner-primary", "fingerprint": "62db7aa575fecca8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-6866"]}}, {"ruleId": "scanner-3ab9b02e0d098689", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in webui/app.py:708"}, "properties": {"repobilityId": "88ddaa91b4306d62", "scanner": "scanner-primary", "fingerprint": "3ab9b02e0d098689", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/app.py"}, "region": {"startLine": 708}}}]}, {"ruleId": "scanner-e19aac54a4073096", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in webui/run.py:82"}, "properties": {"repobilityId": "2ea57e2dacfcbab6", "scanner": "scanner-primary", "fingerprint": "e19aac54a4073096", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/run.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-1680caad34cf5cdd", "level": "note", "message": {"text": "Very large file: examples/prediction_new_GUI.py (1624 lines)"}, "properties": {"repobilityId": "3315c57bd92f31a0", "scanner": "scanner-primary", "fingerprint": "1680caad34cf5cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-da5ae8d8d9b2e51d", "level": "note", "message": {"text": "Very large file: examples/prediction_new.py (1332 lines)"}, "properties": {"repobilityId": "6ea948bdedefb1b7", "scanner": "scanner-primary", "fingerprint": "da5ae8d8d9b2e51d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "97d541b3c9e8127b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-14b25b839fc840da", "level": "error", "message": {"text": "Flask mutation route `load_data` without `@login_required` \u2014 webui/app.py:341"}, "properties": {"repobilityId": "7cf92d67cc6141a8", "scanner": "scanner-primary", "fingerprint": "14b25b839fc840da", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/app.py"}, "region": {"startLine": 341}}}]}, {"ruleId": "scanner-f244e2855f1b367b", "level": "error", "message": {"text": "Flask mutation route `predict` without `@login_required` \u2014 webui/app.py:404"}, "properties": {"repobilityId": "f361bb52b5a0556c", "scanner": "scanner-primary", "fingerprint": "f244e2855f1b367b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/app.py"}, "region": {"startLine": 404}}}]}, {"ruleId": "scanner-fc162839795f72e9", "level": "error", "message": {"text": "Flask mutation route `load_model` without `@login_required` \u2014 webui/app.py:626"}, "properties": {"repobilityId": "4024c1f102224b6c", "scanner": "scanner-primary", "fingerprint": "fc162839795f72e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/app.py"}, "region": {"startLine": 626}}}]}, {"ruleId": "scanner-12caa9b99e965b2a", "level": "warning", "message": {"text": "Vulnerable dependency flask 2.3.3: GHSA-68rp-wp8r-4726"}, "properties": {"repobilityId": "b8cb2a566f2fccf9", "scanner": "scanner-primary", "fingerprint": "12caa9b99e965b2a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-68rp-wp8r-4726"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd16bb6763dcfe73", "level": "warning", "message": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-43qf-4rqw-9q2g"}, "properties": {"repobilityId": "cfc50cdfb5b60d1f", "scanner": "scanner-primary", "fingerprint": "fd16bb6763dcfe73", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-43qf-4rqw-9q2g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cf5c40cac478896", "level": "warning", "message": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-7rxf-gvfg-47g4"}, "properties": {"repobilityId": "1ddf3b3ff990b143", "scanner": "scanner-primary", "fingerprint": "6cf5c40cac478896", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7rxf-gvfg-47g4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11b3797f00c803ab", "level": "warning", "message": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-84pr-m4jr-85g5"}, "properties": {"repobilityId": "70c0e8b8f33b2b4e", "scanner": "scanner-primary", "fingerprint": "11b3797f00c803ab", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-84pr-m4jr-85g5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86a1e69d1ce5318f", "level": "warning", "message": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-8vgw-p6qm-5gr7"}, "properties": {"repobilityId": "d8b616f02890ad8b", "scanner": "scanner-primary", "fingerprint": "86a1e69d1ce5318f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8vgw-p6qm-5gr7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df21023010680732", "level": "error", "message": {"text": "Vulnerable dependency flask-cors 4.0.0: GHSA-hxwh-jpp2-84pm"}, "properties": {"repobilityId": "8e66215e0e615aa4", "scanner": "scanner-primary", "fingerprint": "df21023010680732", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hxwh-jpp2-84pm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fa80e9a80b6e6ea1", "level": "warning", "message": {"text": "Dependency flask-cors is two or more major versions behind"}, "properties": {"repobilityId": "a102d6e8e8219b48", "scanner": "scanner-primary", "fingerprint": "fa80e9a80b6e6ea1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7751df3f90790acd", "level": "note", "message": {"text": "Dependency flask is a major version behind"}, "properties": {"repobilityId": "8d80cbc12638fbb8", "scanner": "scanner-primary", "fingerprint": "7751df3f90790acd", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5980678dac1ea93", "level": "note", "message": {"text": "Dependency huggingface_hub is a major version behind"}, "properties": {"repobilityId": "65c85b0f629f01e6", "scanner": "scanner-primary", "fingerprint": "e5980678dac1ea93", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d77d0f592c65df8", "level": "note", "message": {"text": "Dependency pandas is a major version behind"}, "properties": {"repobilityId": "d44974a3d0beed74", "scanner": "scanner-primary", "fingerprint": "6d77d0f592c65df8", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-837cacf0faaad05c", "level": "note", "message": {"text": "Dependency plotly is a major version behind"}, "properties": {"repobilityId": "78af113d25379dd5", "scanner": "scanner-primary", "fingerprint": "837cacf0faaad05c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "webui/requirements.txt"}, "region": {"startLine": 1}}}]}]}]}